Update savedsearches.conf

Author: gjanders

default/savedsearches.conf

@@ -8401,6 +8401,10 @@ search = index=_audit `searchheadhosts` TERM(info=completed) search_id!="'rsa_*"
 | rex field=search mode=sed "s/\n/ /g" \
 | rex field=search mode=sed "s/```.*?```/ /g" \
 | eval search=if(substr(search,len(search),len(search)-1)=="'",substr(search,0,len(search)-1),search)\
+``` splparse is from GV Utils app, works for splitting the data into search lines to prevent rex errors while extracting macros. This provides more accuracy but requires the GV Utils app from splunkbase, replace the rex / macro lien with the below \
+| splparse search \
+| rex field=parsed_search "`\s*(?P<macro>.*?)\s*`" max_match=0 \
+``` \
 | rex field=search "`\s*(?P<macro>.*?)\s*`" max_match=0\
 | eval search_head=host\
 | eval search_head_cluster=`search_head_cluster`\