diff --git a/docs/search/search-query-language/search-operators/macro.md b/docs/search/search-query-language/search-operators/macro.md index 7a82378c85..5b3efe26c4 100644 --- a/docs/search/search-query-language/search-operators/macro.md +++ b/docs/search/search-query-language/search-operators/macro.md @@ -108,13 +108,32 @@ _sourceCategory=error | `timeslice_macro()` To view any existing macro, follow the steps below: 1. [**New UI**](/docs/get-started/sumo-logic-ui/). In the main Sumo Logic menu, select **Data Managemenu**, and then under **Logs**, select **Macros**. You can also click the **Go To...** menu at the top of the screen and select **Macros**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data** > **Logs** > **Macros**. -1. In the **Macros** page, click on any of the macros that you want to view the macro details.
macro-logs-page -1. To use the selected macro in your log search query, copy the suggested **Usage** of the macro and include it in your query syntax.
view-macro-logs-details +1. On the **Macros** page, click on any of the macros that you want to view the macro details.
macro-logs-page +1. To use the selected macro in your log search query, copy the suggested **Usage** of the macro.
view-macro-logs-details +1. On the Log Search page, enter your query and add the copied macro directly into the query syntax. Alternatively, you can type **`** to open the macro suggestions dropdown and select the desired macro to insert into your query.
macro-in-line-suggestions + :::info + You can hover over the pasted macro to view and verify the macro name, definition, and usage details before use. + ::: + +## Macro recommendations + +Macro recommendations are automatically generated based on the most frequently run queries within your organization. By converting these recommended queries into macros, you can streamline repetitive tasks and improve overall efficiency. + +:::note +Users with the **View Macro** capability can only view macro recommendations. To accept (+ Add Macro) or reject a recommendation, you must have the **Manage Macro** capability. +::: + +Follow the below steps to view the macro recommendations: + +1. [**New UI**](/docs/get-started/sumo-logic-ui/). In the main Sumo Logic menu, select **Data Managemenu**, and then under **Logs**, select **Macros**. You can also click the **Go To...** menu at the top of the screen and select **Macros**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data** > **Logs** > **Macros**. +1. Click on the macro-recommendations-button button to open the **Macro Recommendation** page. This page displays recommendations based on most frequently run queries in your org.
macro-recommendations + 1. Click **Reject** to remove a macro recommendation from the list. + 1. Click **+ Add Macro** to accept the macro recommendation. You will be redirected to **Create Macro** page, where you can follow the instruction in the [Add a Macro](#add-a-macro) section to complete the macro creation process. ## Edit a macro operator 1. [**New UI**](/docs/get-started/sumo-logic-ui/). In the main Sumo Logic menu, select **Data Management**, and then under **Logs**, select **Macros**. You can also click the **Go To...** menu at the top of the screen and select **Macros**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data** > **Logs** > **Macros**. -1. In the **Macros** page, click on any of the macros that you want to edit.
macro-logs-page +1. On the **Macros** page, click on any of the macros that you want to edit.
macro-logs-page 1. Click **Edit** button to open the pane for editing.
macro-delete-pop-up 1. In the **Edit [macroname] macro** pop-up, click on **Continue**. You can also check where your macros have been used to avoid broken queries by clicking on **check queries that reference this macro**.
macro-delete-pop-up 1. In the macro editing pane, perform the required editing and click **Submit**. @@ -122,6 +141,6 @@ To view any existing macro, follow the steps below: ## Delete a macro operator 1. [**New UI**](/docs/get-started/sumo-logic-ui/). In the main Sumo Logic menu, select **Data Management**, and then under **Logs**, select **Macros**. You can also click the **Go To...** menu at the top of the screen and select **Macros**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data** > **Logs** > **Macros**. -1. In the **Macros** page, click on any of the macros that you want to delete.
macro-logs-page +1. On the **Macros** page, click on any of the macros that you want to delete.
macro-logs-page 1. Click **Delete** button to delete the macro.
macro-delete-button 1. In the **Delete [macroname] macro** pop-up, click on **Delete**. You can also check where your macros have been used to avoid broken queries by clicking on **check queries that reference this macro**.
macro-delete-pop-up diff --git a/static/img/search/searchquerylanguage/search-operators/macro-in-line-suggestions.png b/static/img/search/searchquerylanguage/search-operators/macro-in-line-suggestions.png new file mode 100644 index 0000000000..5fd83abbe6 Binary files /dev/null and b/static/img/search/searchquerylanguage/search-operators/macro-in-line-suggestions.png differ diff --git a/static/img/search/searchquerylanguage/search-operators/macro-recommendations-button.png b/static/img/search/searchquerylanguage/search-operators/macro-recommendations-button.png new file mode 100644 index 0000000000..8dd563376b Binary files /dev/null and b/static/img/search/searchquerylanguage/search-operators/macro-recommendations-button.png differ diff --git a/static/img/search/searchquerylanguage/search-operators/macro-recommendations.png b/static/img/search/searchquerylanguage/search-operators/macro-recommendations.png new file mode 100644 index 0000000000..037fa0652b Binary files /dev/null and b/static/img/search/searchquerylanguage/search-operators/macro-recommendations.png differ