diff --git a/docs/search/search-query-language/search-operators/macro.md b/docs/search/search-query-language/search-operators/macro.md index 8eaf44a17f..f4b86cc049 100644 --- a/docs/search/search-query-language/search-operators/macro.md +++ b/docs/search/search-query-language/search-operators/macro.md @@ -21,7 +21,7 @@ To use the `macro` operator, reference it in your query with backticks (``). Mac :::note - Only **Administrators** and **Users** with access to **Query Reference** can run queries using macros. -- Only users with **Administrator** access can create macros. +- Only users with **Manage Macro** capability can create macros. ::: ## Syntax @@ -34,7 +34,7 @@ To use the `macro` operator, reference it in your query with backticks (``). Mac To create a macro, follow the steps below: -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data** > **Logs** > **Macros**.
[**New UI**](/docs/get-started/sumo-logic-ui/). In the top menu, select **Manage Date**, and then under **Logs**, select **Macros**. You can also click the **Go To...** menu at the top of the screen and select **Macros**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data** > **Logs** > **Macros**.
[**New UI**](/docs/get-started/sumo-logic-ui/). In the top menu, select **Manage Data**, and then under **Logs**, select **Macros**. You can also click the **Go To...** menu at the top of the screen and select **Macros**. 1. Click **+ Add Macro**.
macro-logs-page 1. Or, in the log search page, select the part of search query language that needs to be reused and click on **Create Macro**.
macro-search-page 1. **Macro Details**. Enter the name for the macro. Description is optional. @@ -49,6 +49,17 @@ To create a macro, follow the steps below: - You can create a maximum of 50 macros. - You can add a maximum of 5 arguments. - You cannot edit or delete the macro. Submit a customer request to Sumo Logic if you still need to edit or delete a macro. +- You are only allowed to use single expression. +- You can only use the below listed argument validations: + - `isValidIpV4` + - `contains` + - `isNumeric` + - `isPrivateIP` + - `isPublicIP` + - `isValidIP` + - `isReservedIP` + - `isValidIPv4` + - `isValidIPv6` ### Example without arguments @@ -86,6 +97,6 @@ _sourceCategory=error | `timeslice_macro()` To view any existing macro, follow the steps below: -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data** > **Logs** > **Macros**.
[**New UI**](/docs/get-started/sumo-logic-ui/). In the top menu, select **Manage Date**, and then under **Logs**, select **Macros**. You can also click the **Go To...** menu at the top of the screen and select **Macros**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data** > **Logs** > **Macros**.
[**New UI**](/docs/get-started/sumo-logic-ui/). In the top menu, select **Manage Data**, and then under **Logs**, select **Macros**. You can also click the **Go To...** menu at the top of the screen and select **Macros**. 1. In the **Macros** page, click on any of the macros that you want to view the macro details.
macro-logs-page 1. To use the selected macro in your log search query, copy the suggested **Usage** of the macro and include it in your query syntax.
view-macro-logs-details