topic Re: Macro Expansion - Possible Bug in Splunk Search

Macro Expansion - Possible Bug

etoombs — Wed, 10 Apr 2024 21:36:19 GMT

Hi all! I've got an issue with macro expansion taking an excessively long time when you use the keyboard shortcut - ctrl+shift+e. I'm looking for someone to try the same thing on their own system and let me know if you're seeing this to. That will help me determine if this is a problem in my environment or a possible bug in the software.

To test, find any macro in your environment.

Establish baseline:

Enter just the macro name in the search box and press ctrl+shift+e (or command+shift+e, I think, on MAC). Note the length of time it takes for the modal pop up to show you the expanded macro. It is not necessary to run the search.

`mymacro`

Test issue:

Using the same macro as above, create a simple search that has the macro inside of a sub-search. Try expanding the macro. Are you getting a slow response? For me, it's >20 seconds for it to expand the macro

|makeresults
|append [`mymacro`]

I appreciate the help from anyone willing to test.

Re: Macro Expansion - Possible Bug

bowesmana — Thu, 11 Apr 2024 00:19:42 GMT

No difference - same speed - what's your macro doing?

Re: Macro Expansion - Possible Bug

richgalloway — Thu, 11 Apr 2024 12:22:01 GMT

Same speed here.

What is your environment like?

Re: Macro Expansion - Possible Bug

etoombs — Thu, 11 Apr 2024 13:25:48 GMT

Hi! Thanks for checking. So... I did more digging on my side. On a non-clustered search head, I've got no delay. On my clustered-search heads, I do. I have two SH clusters and both are impacted. Splunk version is 9.1.1.

Re: Macro Expansion - Possible Bug

etoombs — Thu, 11 Apr 2024 13:28:08 GMT

It doesn't seem to matter. The macro expansion can be as simple as a single word that it's replacing and the problem still happens.

Re: Macro Expansion - Possible Bug

richgalloway — Thu, 11 Apr 2024 13:46:24 GMT

I just checked on a Splunk Cloud SHC and saw to difference in expansion time so I suspect there's something happening in your environment.

Do you see any relevant messages in splunkd.log on the SH?