Are there specific permissions needed in order for the Machine Learning to talk to the Search app?

[aohls]

I have a Forecast time series that runs in the Machine Learning App correctly.
What I want to do is integrate that into a dashboard so I can feed it some tokens to run for different hosts.
I am re-reading through to documentation to see if something is missed, I do not have a saved model from
this I see that I can use the apply function.

Does any specific permission need to be changed in order for the ML to talk to the Search app?

I get the following error:

"Error in 'SearchParser': The search specifies a macro 'forecastviz' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information."

[woodcock · Accepted solution]

The MLTK creates a custom command forecastviz. You ought to be able to go into the MLTK app, then click Settings -> Advanced search -> Search commands (or possibly macros if it is actually a macro) , search for it, find it, then click Permissions and change it to All Apps which is Global.

[aohls]

This was it. In this case it was Macros and they are only shared in the App.

[niketn]

@aohls try changing permission on MLTK app as per one of my older answers: https://answers.splunk.com/answers/660004/outliers-viz-not-loading.html

[woodcock]

We need WAAAAAAY more detail. Show us ALL of your SPL.

[aohls]

@woodcock Search is below; I was more questioning the permission aspect, not so much the syntax if that makes sense. I want to make sure if there is anything needed so I can import my ML items as a Dashboard Panel. I am really the only user and the setup is done by another team and I do not get much insight. To get the search I went in to the ML ran my Experiment then selected show in search. I then copied and pasted it into a Search and Reporting search.

sourcetype=userservice
| where Accounts<1250 AND Accounts > 750
| eval MStoS=case(Milliseconds!=0,Milliseconds/1000,Milliseconds = 0, 0)
| eval MtoS =case(Seconds!=0,Seconds/1000,Seconds = 0, 0)
| eval TotalTime = MtoS + MStoS + Seconds
| eval SPerAccount=(TotalTime/Accounts)
| bucket _time span=day
| stats sum(Accounts) AS Accounts,sum(TotalTime) AS ProcessingTime, avg(SPerAccount) AS SPerAccount, count(_raw) AS Batch by _time
| where ProcessingTime > 1000 AND ProcessingTime < 20000 | predict "ProcessingTime" as prediction algorithm=LLP5 holdback=0 future_timespan=1 period=1 upper80=upper80 lower80=lower80 | `forecastviz(1, 0, "ProcessingTime", 80)`

It runs fine in the ML search area, but fails in the Search and Reporting which makes me think there is some permission item.