CylancePROTECT App for Splunk: Why is Macro broken in my distributed environment?

[itradeclayton]

After this last update, my searches no longer work because the eventtype search fails. The cylance_index macro doesn't seem to be replicating to the indexers and I get these errors:

[xxxINDEXER_SERVER_NAMExxx] Error in 'SearchParser': The search specifies a macro 'cylance_index' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I'm not certain yet how to get this to replicate from my search heads (not clustered) to my indexers (clustered).

[TonyLeeVT]

Do you have the Cylance app installed on your search heads? https://splunkbase.splunk.com/app/3233

Do you have the Cylance TA installed on your indexers? TA: https://splunkbase.splunk.com/app/3709/

[itradeclayton]

we no longer have cylance so it's a moot point for us... 🙂

[meglin_splunk]

It might be due to macros not replicating to the Indexers in the bundle. By default, macro config files do not get included.

Try adding the following to your distsearch.conf :

[replicationSettings:refineConf]

Replicate these specific *.conf files and their associated *.meta stanzas.

replicate.macros = true