When defining a search macro, the required elements are the name and the definition of the macro. The name is a unique identifier for the macro that can be used to invoke it in other searches. The definition is the search string that the macro expands to when referenced. The arguments, validation expression, and validation error message are optional elements that can be used to customize the macro behavior and input validation2
1: Splunk Core Certified Power User Track, page 9. 2: Splunk Documentation, Define search macros in Settings.

https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Eval The eval command calculates an expression and puts the resulting value into a search results field.
If the field name that you specify does not match a field in the output, a new field is added to the search results.
If the field name that you specify matches a field name that already exists in the search results, the results of the eval expression overwrite the values in that field.

The type of workflow action that sends field values to an external resource (e.g. a ticketing system) is POST.
A POST workflow action allows you to send a POST request to a URI location with field values or static values as arguments. For example, you can use a POST workflow action to create a ticket in an external system with information from an event.