https://community.splunk.com/t5/Splunk-Search/ERROR-SearchParser/m-p/470721#M192184 <P>Many apps ship with blank <CODE>macro</CODE> definitions which the Splunk admin is supposed to modify so that the SPL in the app knows what <CODE>index/sourcetype</CODE> contains the data that it needs to run. Read the documentation for your app.</P> Mon, 28 Oct 2019 23:07:46 GMT woodcock 2019-10-28T23:07:46Z https://community.splunk.com/t5/Splunk-Search/ERROR-SearchParser/m-p/470719#M192182 <P>ERROR SearchParser - The search specifies a macro 'bcoat_request' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.</P> <P>Guys, help me, haw can i resolve this problem?</P> Mon, 28 Oct 2019 18:15:03 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-SearchParser/m-p/470719#M192182 erlindemberg 2019-10-28T18:15:03Z https://community.splunk.com/t5/Splunk-Search/ERROR-SearchParser/m-p/470720#M192183 <P>Have you tried the suggestion offered in the error message? Go to Settings-&gt;Advanced search-&gt;Search macros and verify the "bcoat_request" macro exists and is shared with the app in which you are trying to use it. If it doesn't exist, re-install the Bluecoat app to restore the macro.</P> Mon, 28 Oct 2019 19:23:30 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-SearchParser/m-p/470720#M192183 richgalloway 2019-10-28T19:23:30Z https://community.splunk.com/t5/Splunk-Search/ERROR-SearchParser/m-p/470721#M192184 <P>Many apps ship with blank <CODE>macro</CODE> definitions which the Splunk admin is supposed to modify so that the SPL in the app knows what <CODE>index/sourcetype</CODE> contains the data that it needs to run. Read the documentation for your app.</P> Mon, 28 Oct 2019 23:07:46 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-SearchParser/m-p/470721#M192184 woodcock 2019-10-28T23:07:46Z