topic Re: eventtype which contains macro is not working in Splunk Search

eventtype which contains macro is not working

thambisetty — Wed, 12 Apr 2017 08:48:51 GMT

Hi Splunkers,

I have distributed environment. when I tried searching for eventtype which contains macro is not working.

I have seen docs saying that macros are by default skipped from search head knowledge bundle. But, I have added distsearch.conf in TA where eventtype resides and I can see macros.conf in knowledge bundle getting replicated to search peers. still I am not able to get results from eventtype . when I expand eventtype in search showing results.

Thanks in advance.

Re: eventtype which contains macro is not working

rjthibod — Wed, 12 Apr 2017 10:33:41 GMT

There was an actual bug in Splunk for a while that was preventing this from working. I don't know if it was ever officially fixed or not, but I gave up on using macros in eventtypes being that everything seemed to be brittle or unreliable.

Last time I heard others discussing it, they seemed to indicate it was still an issue.

Re: eventtype which contains macro is not working

martin_mueller — Wed, 12 Apr 2017 10:42:52 GMT

What version of splunk are you using?

If you're on 6.5.x, upgrade to 6.5.3: http://docs.splunk.com/Documentation/Splunk/6.5.3/ReleaseNotes/6.5.3#Uncategorized_issues
If you're on 6.4.x, wait for 6.4.7 (allegedly).
If you're on 6.3.x, upgrade to 6.5.3 🙂
If you're on 6.2.x or earlier, eventtypes with macros should work.

Re: eventtype which contains macro is not working

thambisetty — Wed, 12 Apr 2017 12:26:24 GMT

Thanks Martin_mueller..

Running on 6.5.2. I will update my splunk to latest version.

Re: eventtype which contains macro is not working

thambisetty — Wed, 12 Apr 2017 12:27:35 GMT

Yes, It was listed and fixed in splunk latest version.

find comment below from martin_mueller

Re: eventtype which contains macro is not working

ww9rivers — Thu, 28 Jun 2018 21:03:17 GMT

We are running Splunk 7.0.3, in a distributed setting.

On a search cluster running Splunk Enterprise Security, we added the SentenilOne TA, made it work inside ES to search with a macro (s1_index) defined in the TA.

However, when searching in ES with "tag=malware" which pulls in that macro, we get these error messages from our indexers:

Error in 'SearchParser': The search specifies a macro 's1_index' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

Inspecting the search job, I find this in the "remoteSearch":

( `s1_index` sourcetype=threat )

That seems to mean that the macro is not expanded locally before dispatch, nor is the macro definition included in the search bundle.

Re: eventtype which contains macro is not working

martin_mueller — Fri, 29 Jun 2018 06:34:17 GMT

Did you configure distsearch.conf as mentioned in the question?

Re: eventtype which contains macro is not working

ww9rivers — Thu, 12 Jul 2018 19:19:02 GMT

Yes. I have added this stanza in the distsearch.conf file:

[replicationSettings:refineConf]
replicate.macros = true

Re: eventtype which contains macro is not working

sujanay02 — Tue, 24 Sep 2019 05:40:39 GMT

Hi,
I am also facing the same issue in Splunk 7.1.1 version.i tried adding config in distsearch.conf as well.still doe not work out.Do you have the resolution for this ?