Security

What configuration do I need to change for users other than admin to use a macro?

imanpoeiri
Communicator

Hi Experts,

I use the following macro, and it works perfectly fine with admin role until I created new users (with limited capabilities of course) and I noticed it does not work for them. Any clue what capabilities that I should enable for other users to use the macro?

Sample macro

[macro_number_one(1)]
args = type
definition = case("$type$"="main", "index=some_index_01", "$type$"="itsm", "index=some_index_01", 1=1, "index=some_index_01")
iseval = 1

results are only displaying the macro name on the panel:

macro_number_one
0 Karma

jeffland
SplunkTrust
SplunkTrust

Did you check the permission on the macro? If it's private for admin, no other user will be able to use it (unless it has admin capabilities).

imanpoeiri
Communicator

Hi @jeffland,

Do you mind to share with me how to check macro.prop whether under admin or other users? Because as far as I know, it just a file and I drop it on application's default folder.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Well usually you can just check and edit such things via the gui, via Settings - Advanced Search - Search Macros. But if you placed it in the default folder, then the macro can't be private - so it has to be another reason.
Have you tried creating the macro from the gui and setting its permissions to app or global level?

0 Karma

imanpoeiri
Communicator

Hi @jeffland,

Still no luck even after I create it via GUI, however if I inherit the role from admin it working fine! I suspect one of the capabilities need to be applied but not sure which capabilities.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Which capabilites does the user have (both itself and inherited)? Every role needs to have at least rest_properties_get and search to be useful. I just created a role with these two capabilites, assigned a user that role and was able to use a macro which I created with app-level permission for as that new user. There's no capability needed to use macros.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...