topic Re: migration in Installation

migration

SN1 — Fri, 21 Feb 2025 04:57:47 GMT

so i copied enterprise security app folder from old sh to new but it is showing macro error not found where i can find the macro of this app and how to migrate them also.

Re: migration

kiran_panchavat — Fri, 21 Feb 2025 05:15:45 GMT

@SN1

Locate Macros in the Old Search Head

From the Splunk UI:

Navigate to Settings > Advanced Search > Search Macros

Re: migration

kiran_panchavat — Fri, 21 Feb 2025 05:18:13 GMT

@SN1When migrating from an old search head to a new one, it's essential to ensure that all configurations, including macros, are correctly transferred. However, if you're encountering issues such as missing macros after the migration, it indicates that some components may not have been properly moved. To address this, I recommend reaching out to Splunk Support for personalized assistance.

Re: migration

livehybrid — Fri, 21 Feb 2025 06:55:18 GMT

Hi @SN1

I would recommend running the following on our old SH to find out where the macro is easily:

/opt/splunk/bin/splunk btool macros list MacroName --debug

Replace MacroName with the name of your missing macro - this should output a the configuration of the macro and include the path that the macro resides in.

If you still do not see the macro there then it could be a private Knowledge Object. Did you copy you user's custom data from /opt/splunk/etc/users aswell? Did you copy all the apps from the old SH to the new SH?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: migration

gcusello — Fri, 21 Feb 2025 06:52:12 GMT

Hi @kiran_panchavat ,

adding a bit of information the the perfect answer of @kiran_panchavat:

it's always a best practice to save all the customizations that you did in ES in a custom app, e.g. custom field extractions, custom correlation searches or dashboards or reports, or, as in your case, macros: don't leave anything custom in the Enterprise Security (and the other module) app.

Ciao.

Giuseppe