topic Re: Macro in Splunk Enterprise Security

Macro

SN1 — Mon, 24 Feb 2025 08:27:14 GMT

Hi I have this search

| `es_notable_events` | search timeDiff_type=current | timechart minspan=30m sum(count) as count by security_domain

when I am searching macro `es_notable_events` it is not showing any result for all apps and any owner but the search is giving results and when running macro it is also showing results.

Re: Macro

ITWhisperer — Mon, 24 Feb 2025 09:06:04 GMT

Please expand on what you mean for each scenario when you are getting results and when you are not getting results?

If there are multiple commands in your SPL, try removing them one at a time until the situation changes, so you can identify the step which is causing the issue.

Re: Macro

SN1 — Mon, 24 Feb 2025 13:11:02 GMT

every command is giving results thats not the problem , problem the macro which is used in this search when i am searching this macro it is giving me no result.

Re: Macro

ITWhisperer — Mon, 24 Feb 2025 16:27:45 GMT

Try removing the back ticks when you are searching for a macro.

Check the permissions on the macro

Use <ctrl><shft>E while your cursor is in the search box to expand the macro to check it is doing what you expect