topic Re: How to execute macro search with REST API in Splunk Search

How to execute macro search with REST API

pravinvram — Tue, 13 Oct 2020 05:47:27 GMT

How do i execute macros in rest API , example :

curl -ku user:pass https://<url> -d search="`macro name` | table data1 data2"

richgalloway — Tue, 13 Oct 2020 15:24:04 GMT

Escape the backticks.

curl -ku user:pass https://<url> -d search="\`macro name\` | table data1 data2"

pravinvram — Wed, 14 Oct 2020 07:17:17 GMT

@richgalloway - thanks for the details , tired that as well however receiving below error.

I own the macro and there is full permission read , still getting this error

<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="FATAL">User could not act as: admin</msg>
</messages>
</response>

richgalloway — Wed, 14 Oct 2020 13:39:34 GMT

It looks like the macro is trying to execute, but the content requires permissions you don't have. What are the search and macro trying to do?