Splunk Search

What is the root cause of the message preventing saving a search: "Error in 'SearchParser': The search specifies a macro.."

landen99
Motivator

What is the root cause of the message preventing saving a search:
alt text
Error in 'SearchParser': The search specifies a macro..
This error started appearing after a migration from an old SHC to a new SHC.

The resolution was to move the macro to the same app as the search, even though it was set to Global sharing, but that doesn't explain the root cause. The error returns when the macro is moved back to the original app.

Tags (1)
0 Karma

jpolvino
Builder

What happens when you grab that search and run it on its own in the app, with the macro in its native location set as global?

Same as above, but with the macro homed to the app you're running from?

One test in each case is to expand all the macros with Control-Shift-E. Might take a minute.

When I'm in app "A" and do Control-Shift-E on a macro from app "B" that is shared global (with Everyone=Read, Power=Write) it expands and works fine.

Finally, check your App permissions (where the macro lives). Mine says Everyone=Read, Power=Write, and the bottom radio button is true.

0 Karma

landen99
Motivator

The macro works fine at the SPL line. Permissions are global.

0 Karma

niketn
Legend

@landen99 if you put back the SPL for macro wildfire do the other macros work? Have you checked permission/app for other macros and compare them with wildfire in case others work?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...