What is the proper syntax for using a macro named "us_sales"?

The proper syntax for using a macro in Splunk is to enclose the macro name in backticks. This happens because backticks indicate to Splunk that the text inside them is a macro that needs to be resolved or expanded at runtime. By using backticks around "us_sales", you instruct Splunk to look for a macro with that name and substitute it with the corresponding definition or saved search it represents.

In the context of Splunk, macros are powerful tools that allow users to encapsulate commonly used search expressions or commands, enhancing reusability and making searches easier to manage. When executing a search or a command that involves the macro, the backticks are crucial for proper recognition and execution.

Other forms presented, such as using quotation marks, parentheses, or simply the macro name itself without any enclosing characters, do not convey to Splunk that this is a macro, which would lead to an error or misinterpretation. Without backticks, the system treats those inputs as literals or variables rather than as a directive to expand the macro definition.