https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-locate-and-edit-an-existing-macro-search-from-an-app/m-p/275948#M32239 <P>Is there anyway to locate and edit an existing macro search from an App (SA-nix) in this case?</P> <PRE><CODE> CPU_Exceeds_Percent_by_Host Open in Search Edit admin SA-nix Global CPU_Under_Percent_by_Host Open in Search Edit admin SA-nix Global Disk_Used_Exceeds_Perc_by_Host Open in Search Edit admin SA-nix Global IO_Utilization_Exceeds_Threshold Open in Search Edit admin SA-nix Global IO_Wait_Exceeds_Threshold Open in Search Edit admin SA-nix Global </CODE></PRE> <P>An example search macro from SA-nix. If I try to append it with function I got an error. Thoughts?</P> <PRE><CODE>`CPU_Exceeds_Percent_by_Host("`_unix_alert_threshold_CPU_Exceeds_Percent_by_Host`")` </CODE></PRE> <P>This results in:</P> <PRE><CODE>Error in 'fields' command: Invalid argument: 'earliest=-30m' `CPU_Exceeds_Percent_by_Host("`_unix_alert_threshold_CPU_Exceeds_Percent_by_Host`")` earliest=-30m </CODE></PRE> Wed, 09 Dec 2015 21:57:29 GMT leochan 2015-12-09T21:57:29Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-locate-and-edit-an-existing-macro-search-from-an-app/m-p/275948#M32239 <P>Is there anyway to locate and edit an existing macro search from an App (SA-nix) in this case?</P> <PRE><CODE> CPU_Exceeds_Percent_by_Host Open in Search Edit admin SA-nix Global CPU_Under_Percent_by_Host Open in Search Edit admin SA-nix Global Disk_Used_Exceeds_Perc_by_Host Open in Search Edit admin SA-nix Global IO_Utilization_Exceeds_Threshold Open in Search Edit admin SA-nix Global IO_Wait_Exceeds_Threshold Open in Search Edit admin SA-nix Global </CODE></PRE> <P>An example search macro from SA-nix. If I try to append it with function I got an error. Thoughts?</P> <PRE><CODE>`CPU_Exceeds_Percent_by_Host("`_unix_alert_threshold_CPU_Exceeds_Percent_by_Host`")` </CODE></PRE> <P>This results in:</P> <PRE><CODE>Error in 'fields' command: Invalid argument: 'earliest=-30m' `CPU_Exceeds_Percent_by_Host("`_unix_alert_threshold_CPU_Exceeds_Percent_by_Host`")` earliest=-30m </CODE></PRE> Wed, 09 Dec 2015 21:57:29 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-locate-and-edit-an-existing-macro-search-from-an-app/m-p/275948#M32239 leochan 2015-12-09T21:57:29Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-locate-and-edit-an-existing-macro-search-from-an-app/m-p/275949#M32240 <P>its not advisable to change the objects which are part of an app because when you upgrade the app, all your changes will be overwritten. You can write a different macro and use it in case needed.</P> <P>However, macros are available on disk </P> <PRE><CODE>$SPUNK_HOME/etc/apps/SA-nix/default/macros.conf </CODE></PRE> <P>Copy the default macros to $SPUNK_HOME/etc/apps/SA-nix/local/macros.conf and make changes if you still require</P> Thu, 10 Dec 2015 04:08:08 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-locate-and-edit-an-existing-macro-search-from-an-app/m-p/275949#M32240 renjith_nair 2015-12-10T04:08:08Z