Reference:https://answers.splunk.com/answers/574643/field-showing-an-additional-and-not-visible-value-1.html
To use a macro in a search, you must enclose the macro name and any arguments in single quotation marks1.
For example, 'my_macro(arg1,arg2)' is a valid way to use a macro with two arguments. You can use macros
anywhere in your search string where you would normally use a search command or expression1. Therefore,
options A and C are valid searches that use macros, while options B and D are invalid because they do not
enclose the macros in single quotation marks.