{"id":356,"date":"2025-10-14T08:59:38","date_gmt":"2025-10-14T08:59:38","guid":{"rendered":"https:\/\/logsmith.io\/?p=356"},"modified":"2025-10-14T09:06:21","modified_gmt":"2025-10-14T09:06:21","slug":"macro-driven-rule-logic","status":"publish","type":"post","link":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/","title":{"rendered":"\ud83e\udde0 Macro-Driven Rule Logic &#8211; Splunk Masterclass 1\/5"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">\ud83d\udc4b Welcome to the LogSmith Splunk Masterclass<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This series is for detection engineers, Splunk admins, and SOC architects who want <strong>real-world techniques<\/strong> that go beyond the documentation. Each Masterclass entry shares actionable insight from high-signal, high-volume environments \u2014 and today we\u2019re kicking off with one of my favourite Splunk tricks:<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd27 Macro-Driven Rule Logic<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You know the drill. A security rule starts as a few clean lines. A few weeks later, it\u2019s a tangled jungle of <code>eval<\/code> statements, field renames, nested <code>if<\/code> conditions, and suppression logic that only one person understands.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This gets worse fast in large Splunk ES environments \u2014 especially with:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Multiple data sources<\/li>\n\n\n\n<li>Rule variants per environment<\/li>\n\n\n\n<li>Shifting field names and index locations<\/li>\n\n\n\n<li>Analysts needing consistency<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">So how do we clean this up?<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udca1 What Are Macros in Splunk?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Macros in Splunk let you abstract pieces of search logic into reusable chunks. Think of them as <strong>functions for your correlation rules<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are two main types:<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd39 <strong>Search Macro<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of repeating logic like this in 30 rules:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>index=windows_logs sourcetype=WinEventLog:Security EventCode=4624\n| eval is_successful_login = ...\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You define:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>`successful_windows_login_events`\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Defined in <code>macros.conf<\/code>, they:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reduce rule length and clutter<\/li>\n\n\n\n<li>Promote consistency across rules<\/li>\n\n\n\n<li>Allow logic to be versioned and tested separately<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd38 <strong>Index Macros<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is where the real power of macros shows up in large-scale or multi-tenant environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of hardcoding:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>index=wineventlog OR index=custom_win_sec_logs\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>`windows_security_indexes`\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">With the macro defined as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;windows_security_indexes]\ndefinition = index=wineventlog OR index=custom_win_sec_logs\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now you can:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Centrally manage which indexes are in-scope<\/li>\n\n\n\n<li>Tune rules to different regions, tenants, or stages<\/li>\n\n\n\n<li>Promote rules without worrying about index mismatches<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udccc Example: Environment-Specific Rule Scoping<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s say:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>One rule should only run in EU environments<\/li>\n\n\n\n<li>Another needs to be disabled in staging<\/li>\n\n\n\n<li>A third is used by different customers with different data sources<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of duplicating rules or editing SPL every time, use macros:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;eu_only_indexes]\ndefinition = (index=eu_logs_* OR index=shared_eu_win_logs)\n\n&#91;exclude_staging_indexes]\ndefinition = NOT index=staging_noise_logs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In your SPL:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>`eu_only_indexes`\n`exclude_staging_indexes`\n`successful_windows_login_events`\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now your rules are <strong>environment-aware<\/strong>, without being <strong>environment-dependent<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u2705 When Macros Make Sense<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use macros for logic that\u2019s:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Repetitive<\/strong>: e.g., standard authentication event filters<\/li>\n\n\n\n<li><strong>Environment-specific<\/strong>: e.g., index names, field aliases<\/li>\n\n\n\n<li><strong>Error-prone<\/strong>: e.g., long suppression conditions<\/li>\n\n\n\n<li><strong>Critical to promote<\/strong>: e.g., BY field alignment for analytics stories<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\ude80 Real Benefits<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83e\uddfc 1. Cleaner Rules<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Easier to read, explain, and debug. You can onboard new rules faster when the logic is broken into named blocks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd01 2. Better Rule Promotion<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re working GitLab-style rule promotion workflows, macros give you a <strong>layered architecture<\/strong> \u2014 separating search logic from rule logic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Promote macros independently<\/li>\n\n\n\n<li>Test them in isolation<\/li>\n\n\n\n<li>Use stable references across dozens of rules<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd12 3. Safer Deployments<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Abstracting environment config (like <code>index<\/code> names or <code>site_name<\/code>) means you reduce the chance of production-breaking mistakes during CI\/CD.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\uddea Use Case Examples<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Use Case<\/th><th>Macro Name<\/th><th>What It Does<\/th><\/tr><\/thead><tbody><tr><td>Standard login events<\/td><td><code>successful_windows_login_events<\/code><\/td><td>Simplifies auth logic<\/td><\/tr><tr><td>Regional field mapping<\/td><td><code>geo_region_by_site<\/code><\/td><td>Adds site-to-region lookup<\/td><\/tr><tr><td>Event suppression<\/td><td><code>noise_suppression_conditions<\/code><\/td><td>Central suppression logic<\/td><\/tr><tr><td>Index abstraction <\/td><td><code>windows_security_indexes<\/code><\/td><td>Simplifies multi-source coverage<\/td><\/tr><tr><td>Region Specific Scoping<\/td><td><code>eu_indexes<\/code><\/td><td>Dynamic index control per tenant or region<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You can even embed macros in your <code>tstats<\/code> pipelines for datamodel-driven searches.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udcd8 Part of the LogSmith Playbook<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This technique forms part of a bigger picture I call <strong>Rule Layering<\/strong> \u2014 where detection rules are treated more like software components. It\u2019s one of the key shifts that separates mature detection engineering teams from reactive SOCs.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udee0 TL;DR<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use macros to clean up messy correlation rules<\/li>\n\n\n\n<li>Keep logic reusable and testable<\/li>\n\n\n\n<li>Fit them into your rule promotion lifecycle<\/li>\n\n\n\n<li>Think in <strong>layers, not blobs<\/strong><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd1c Next time in the Masterclass:<br><strong>\u201cDetection-as-Code &#8211; What it Really Means\u201d<\/strong><\/h2>\n","protected":false},"excerpt":{"rendered":"<p>\ud83d\udc4b Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want&#8230; <\/p>\n<div class=\"art-el-more\"><a href=\"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/\" class=\"art-link art-color-link art-w-chevron\">Read more<\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"iawp_total_views":17,"footnotes":""},"categories":[37],"tags":[30,38,39,40],"class_list":["post-356","post","type-post","status-publish","format-standard","hentry","category-masterclass","tag-detection-engineering","tag-masterclass","tag-playbook","tag-splunk"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.8 - aioseo.com -->\n\t<meta name=\"description\" content=\"\ud83d\udc4b Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want real-world techniques that go beyond the documentation. Each Masterclass entry shares actionable insight from high-signal, high-volume environments \u2014 and today we\u2019re kicking off with one of my favourite Splunk tricks: \ud83d\udd27 Macro-Driven Rule Logic You\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"stebutty\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.8\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"LogSmith -\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udde0 Macro-Driven Rule Logic \u2013 Splunk Masterclass 1\/5 - LogSmith\" \/>\n\t\t<meta property=\"og:description\" content=\"\ud83d\udc4b Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want real-world techniques that go beyond the documentation. Each Masterclass entry shares actionable insight from high-signal, high-volume environments \u2014 and today we\u2019re kicking off with one of my favourite Splunk tricks: \ud83d\udd27 Macro-Driven Rule Logic You\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-10-14T08:59:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-10-14T09:06:21+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"\ud83e\udde0 Macro-Driven Rule Logic \u2013 Splunk Masterclass 1\/5 - LogSmith\" \/>\n\t\t<meta name=\"twitter:description\" content=\"\ud83d\udc4b Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want real-world techniques that go beyond the documentation. Each Masterclass entry shares actionable insight from high-signal, high-volume environments \u2014 and today we\u2019re kicking off with one of my favourite Splunk tricks: \ud83d\udd27 Macro-Driven Rule Logic You\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/#blogposting\",\"name\":\"\\ud83e\\udde0 Macro-Driven Rule Logic \\u2013 Splunk Masterclass 1\\\/5 - LogSmith\",\"headline\":\"\\ud83e\\udde0 Macro-Driven Rule Logic &#8211; Splunk Masterclass 1\\\/5\",\"author\":{\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/author\\\/stebutty\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/logsmith.io\\\/#organization\"},\"datePublished\":\"2025-10-14T08:59:38+00:00\",\"dateModified\":\"2025-10-14T09:06:21+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/#webpage\"},\"articleSection\":\"Masterclass, Detection Engineering, masterclass, playbook, splunk\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/logsmith.io#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/logsmith.io\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/category\\\/masterclass\\\/#listItem\",\"name\":\"Masterclass\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/category\\\/masterclass\\\/#listItem\",\"position\":2,\"name\":\"Masterclass\",\"item\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/category\\\/masterclass\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/#listItem\",\"name\":\"\\ud83e\\udde0 Macro-Driven Rule Logic &#8211; Splunk Masterclass 1\\\/5\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/logsmith.io#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/#listItem\",\"position\":3,\"name\":\"\\ud83e\\udde0 Macro-Driven Rule Logic &#8211; Splunk Masterclass 1\\\/5\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/category\\\/masterclass\\\/#listItem\",\"name\":\"Masterclass\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/#organization\",\"name\":\"LogSmith\",\"url\":\"https:\\\/\\\/logsmith.io\\\/\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/author\\\/stebutty\\\/#author\",\"url\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/author\\\/stebutty\\\/\",\"name\":\"stebutty\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e1dba347d57277353b989e49264b8b013fe6eed788c3370ebda5270222c5eefb?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"stebutty\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/#webpage\",\"url\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/\",\"name\":\"\\ud83e\\udde0 Macro-Driven Rule Logic \\u2013 Splunk Masterclass 1\\\/5 - LogSmith\",\"description\":\"\\ud83d\\udc4b Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want real-world techniques that go beyond the documentation. Each Masterclass entry shares actionable insight from high-signal, high-volume environments \\u2014 and today we\\u2019re kicking off with one of my favourite Splunk tricks: \\ud83d\\udd27 Macro-Driven Rule Logic You\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/logsmith.io\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/2025\\\/10\\\/14\\\/macro-driven-rule-logic\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/author\\\/stebutty\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/logsmith.io\\\/index.php\\\/author\\\/stebutty\\\/#author\"},\"datePublished\":\"2025-10-14T08:59:38+00:00\",\"dateModified\":\"2025-10-14T09:06:21+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/logsmith.io\\\/#website\",\"url\":\"https:\\\/\\\/logsmith.io\\\/\",\"name\":\"LogSmith\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/logsmith.io\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udde0 Macro-Driven Rule Logic \u2013 Splunk Masterclass 1\/5 - LogSmith","description":"\ud83d\udc4b Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want real-world techniques that go beyond the documentation. Each Masterclass entry shares actionable insight from high-signal, high-volume environments \u2014 and today we\u2019re kicking off with one of my favourite Splunk tricks: \ud83d\udd27 Macro-Driven Rule Logic You","canonical_url":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/#blogposting","name":"\ud83e\udde0 Macro-Driven Rule Logic \u2013 Splunk Masterclass 1\/5 - LogSmith","headline":"\ud83e\udde0 Macro-Driven Rule Logic &#8211; Splunk Masterclass 1\/5","author":{"@id":"https:\/\/logsmith.io\/index.php\/author\/stebutty\/#author"},"publisher":{"@id":"https:\/\/logsmith.io\/#organization"},"datePublished":"2025-10-14T08:59:38+00:00","dateModified":"2025-10-14T09:06:21+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/#webpage"},"isPartOf":{"@id":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/#webpage"},"articleSection":"Masterclass, Detection Engineering, masterclass, playbook, splunk"},{"@type":"BreadcrumbList","@id":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/logsmith.io#listItem","position":1,"name":"Home","item":"https:\/\/logsmith.io","nextItem":{"@type":"ListItem","@id":"https:\/\/logsmith.io\/index.php\/category\/masterclass\/#listItem","name":"Masterclass"}},{"@type":"ListItem","@id":"https:\/\/logsmith.io\/index.php\/category\/masterclass\/#listItem","position":2,"name":"Masterclass","item":"https:\/\/logsmith.io\/index.php\/category\/masterclass\/","nextItem":{"@type":"ListItem","@id":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/#listItem","name":"\ud83e\udde0 Macro-Driven Rule Logic &#8211; Splunk Masterclass 1\/5"},"previousItem":{"@type":"ListItem","@id":"https:\/\/logsmith.io#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/#listItem","position":3,"name":"\ud83e\udde0 Macro-Driven Rule Logic &#8211; Splunk Masterclass 1\/5","previousItem":{"@type":"ListItem","@id":"https:\/\/logsmith.io\/index.php\/category\/masterclass\/#listItem","name":"Masterclass"}}]},{"@type":"Organization","@id":"https:\/\/logsmith.io\/#organization","name":"LogSmith","url":"https:\/\/logsmith.io\/"},{"@type":"Person","@id":"https:\/\/logsmith.io\/index.php\/author\/stebutty\/#author","url":"https:\/\/logsmith.io\/index.php\/author\/stebutty\/","name":"stebutty","image":{"@type":"ImageObject","@id":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/e1dba347d57277353b989e49264b8b013fe6eed788c3370ebda5270222c5eefb?s=96&d=mm&r=g","width":96,"height":96,"caption":"stebutty"}},{"@type":"WebPage","@id":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/#webpage","url":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/","name":"\ud83e\udde0 Macro-Driven Rule Logic \u2013 Splunk Masterclass 1\/5 - LogSmith","description":"\ud83d\udc4b Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want real-world techniques that go beyond the documentation. Each Masterclass entry shares actionable insight from high-signal, high-volume environments \u2014 and today we\u2019re kicking off with one of my favourite Splunk tricks: \ud83d\udd27 Macro-Driven Rule Logic You","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/logsmith.io\/#website"},"breadcrumb":{"@id":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/#breadcrumblist"},"author":{"@id":"https:\/\/logsmith.io\/index.php\/author\/stebutty\/#author"},"creator":{"@id":"https:\/\/logsmith.io\/index.php\/author\/stebutty\/#author"},"datePublished":"2025-10-14T08:59:38+00:00","dateModified":"2025-10-14T09:06:21+00:00"},{"@type":"WebSite","@id":"https:\/\/logsmith.io\/#website","url":"https:\/\/logsmith.io\/","name":"LogSmith","inLanguage":"en-US","publisher":{"@id":"https:\/\/logsmith.io\/#organization"}}]},"og:locale":"en_US","og:site_name":"LogSmith -","og:type":"article","og:title":"\ud83e\udde0 Macro-Driven Rule Logic \u2013 Splunk Masterclass 1\/5 - LogSmith","og:description":"\ud83d\udc4b Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want real-world techniques that go beyond the documentation. Each Masterclass entry shares actionable insight from high-signal, high-volume environments \u2014 and today we\u2019re kicking off with one of my favourite Splunk tricks: \ud83d\udd27 Macro-Driven Rule Logic You","og:url":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/","article:published_time":"2025-10-14T08:59:38+00:00","article:modified_time":"2025-10-14T09:06:21+00:00","twitter:card":"summary_large_image","twitter:title":"\ud83e\udde0 Macro-Driven Rule Logic \u2013 Splunk Masterclass 1\/5 - LogSmith","twitter:description":"\ud83d\udc4b Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want real-world techniques that go beyond the documentation. Each Masterclass entry shares actionable insight from high-signal, high-volume environments \u2014 and today we\u2019re kicking off with one of my favourite Splunk tricks: \ud83d\udd27 Macro-Driven Rule Logic You"},"aioseo_meta_data":{"post_id":"356","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"titles":[],"descriptions":[],"socialPosts":{"email":[],"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2025-10-14 08:49:38","updated":"2025-10-14 10:53:00","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/logsmith.io\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/logsmith.io\/index.php\/category\/masterclass\/\" title=\"Masterclass\">Masterclass<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t\ud83e\udde0 Macro-Driven Rule Logic \u2013 Splunk Masterclass 1\/5\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/logsmith.io"},{"label":"Masterclass","link":"https:\/\/logsmith.io\/index.php\/category\/masterclass\/"},{"label":"\ud83e\udde0 Macro-Driven Rule Logic &#8211; Splunk Masterclass 1\/5","link":"https:\/\/logsmith.io\/index.php\/2025\/10\/14\/macro-driven-rule-logic\/"}],"_links":{"self":[{"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/posts\/356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/comments?post=356"}],"version-history":[{"count":5,"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/posts\/356\/revisions"}],"predecessor-version":[{"id":362,"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/posts\/356\/revisions\/362"}],"wp:attachment":[{"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/media?parent=356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/categories?post=356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logsmith.io\/index.php\/wp-json\/wp\/v2\/tags?post=356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}