Why editing Macros is throwing an error?

davebg · ‎08-11-2023

Apologies, but I am new to Splunk and am looking for a little bit of guidance/help.

I am having an issue with one of our apps.

For whatever reason when I try going AdvancedSearch/Macros from with the Network app, the url changes to /data/macros and I get a 404 error.

However, if I manually change it to /admin/macros, I can get in just fine and edit/view macros.

It is only happening under one specific app. Other apps are able to use /data/macros just fine.

I think it might be permission related, but I am unsure where to check or what to look for.

gcusello · ‎08-12-2023

probably the issue is that that macro is still private.

Try to share it al App or Global level and you'll find macros.conf file in the $SPLUNK_HOME/etc/apps/<your-app>/local folder.

Ciao.

Giuseppe