topic Re: How come the comment "macro" is not working? in Splunk Search

How come the comment "macro" is not working?

weidertc — Thu, 24 Jan 2019 21:25:35 GMT

I must be out of my mind. The comments built-in macro since version 6.5.0 gives me an error that it can't find the macro. I'm using the syntax found in the docs here, with my version of splunk in the url so it shows the one for my version.

https://docs.splunk.com/Documentation/Splunk/6.6.10/Search/Addcommentstosearches

index=* sourcetype=* `comment("THIS IS A COMMENT")`

this gives me an error

Error in 'SearchParser': The search specifies a macro 'comment' that cannot be found.

What could I be doing incorrectly?

Chris

Re: How come the comment "macro" is not working?

Vijeta — Thu, 24 Jan 2019 21:33:10 GMT

what version of splunk you are running? Also make sure you are running it in search app.

Re: How come the comment "macro" is not working?

weidertc — Thu, 24 Jan 2019 21:51:09 GMT

i am on v 6.6.10. So I can't run this in all the apps with a search bar? it only works in search app? Everyone here uses their own department's app to segregate pci/phi/etc with permissions.

Re: How come the comment "macro" is not working?

dflodstrom — Thu, 24 Jan 2019 22:04:13 GMT

For some reason the comment macro's sharing is set to "app" out of the box. You'll have to use a configuration package (app) or navigate to Settings>Advanced Search>Macros to update the permissions.

Re: How come the comment "macro" is not working?

Vijeta — Thu, 24 Jan 2019 22:04:22 GMT

Check macros.conf in search app , you can copy macro for comments in other app if you need it. Try if your search with comment macro is working on search app, check permissions and copy to other app if needed.

Re: How come the comment "macro" is not working?

weidertc — Thu, 24 Jan 2019 22:20:57 GMT

thanks, i'll work with the splunk admins.

Re: How come the comment "macro" is not working?

weidertc — Thu, 24 Jan 2019 22:25:19 GMT

Thanks, now I see it, and it's set to app permissions. I'll work with our Splunk admins to update this.

Re: How come the comment "macro" is not working?

petrose — Wed, 30 Sep 2020 02:45:32 GMT

Hi,
I am experiencing the same as Chris but I have investigated the macro properties of the Comment macro:

And I am going to use Comments in the service_iam_na application listed in the Permissions overview.

What is cause of my problem ?

Re: How come the comment "macro" is not working?

petrose — Wed, 06 Nov 2019 09:16:36 GMT

My problem was resolved ! First issue:
'Everyone' had Read access to macro, doesn't mean that every Dashboard can use it...

You have to explicitly allow it to Read the Macro...in order for it to work.