Reference:https://answers.splunk.com/answers/574643/field-showing-an-additional-and-not-visible-value-1.
html
To use a macro in a search, you must enclose the macro name and any arguments in single quotation marks1.
For example, 'my_macro(arg1,arg2)' is a valid way to use a macro with two arguments. You can use macros anywhere in your search string where you would normally use a search command or expression1. Therefore, options A and C are valid searches that use macros, while options B and D are invalid because they do not enclose the macros in single quotation marks.