Security

What configuration do I need to change for users other than admin to use a macro?

imanpoeiri
Communicator

Hi Experts,

I use the following macro, and it works perfectly fine with admin role until I created new users (with limited capabilities of course) and I noticed it does not work for them. Any clue what capabilities that I should enable for other users to use the macro?

Sample macro

[macro_number_one(1)]
args = type
definition = case("$type$"="main", "index=some_index_01", "$type$"="itsm", "index=some_index_01", 1=1, "index=some_index_01")
iseval = 1

results are only displaying the macro name on the panel:

macro_number_one
0 Karma

jeffland
SplunkTrust
SplunkTrust

Did you check the permission on the macro? If it's private for admin, no other user will be able to use it (unless it has admin capabilities).

imanpoeiri
Communicator

Hi @jeffland,

Do you mind to share with me how to check macro.prop whether under admin or other users? Because as far as I know, it just a file and I drop it on application's default folder.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Well usually you can just check and edit such things via the gui, via Settings - Advanced Search - Search Macros. But if you placed it in the default folder, then the macro can't be private - so it has to be another reason.
Have you tried creating the macro from the gui and setting its permissions to app or global level?

0 Karma

imanpoeiri
Communicator

Hi @jeffland,

Still no luck even after I create it via GUI, however if I inherit the role from admin it working fine! I suspect one of the capabilities need to be applied but not sure which capabilities.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Which capabilites does the user have (both itself and inherited)? Every role needs to have at least rest_properties_get and search to be useful. I just created a role with these two capabilites, assigned a user that role and was able to use a macro which I created with app-level permission for as that new user. There's no capability needed to use macros.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...