Why editing Macros is throwing an error?

davebg — Mon, 14 Aug 2023 17:33:37 GMT

Apologies, but I am new to Splunk and am looking for a little bit of guidance/help.

I am having an issue with one of our apps.

For whatever reason when I try going AdvancedSearch/Macros from with the Network app, the url changes to /data/macros and I get a 404 error.

However, if I manually change it to /admin/macros, I can get in just fine and edit/view macros.

It is only happening under one specific app. Other apps are able to use /data/macros just fine.

I think it might be permission related, but I am unsure where to check or what to look for.

Re: Editing Macros

gcusello — Sat, 12 Aug 2023 08:25:54 GMT

probably the issue is that that macro is still private.

Try to share it al App or Global level and you'll find macros.conf file in the $SPLUNK_HOME/etc/apps/<your-app>/local folder.

Ciao.

Giuseppe