All Apps and Add-ons

CylancePROTECT App for Splunk: Why is Macro broken in my distributed environment?

itradeclayton
Path Finder

After this last update, my searches no longer work because the eventtype search fails. The cylance_index macro doesn't seem to be replicating to the indexers and I get these errors:

[xxxINDEXER_SERVER_NAMExxx] Error in 'SearchParser': The search specifies a macro 'cylance_index' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I'm not certain yet how to get this to replicate from my search heads (not clustered) to my indexers (clustered).

0 Karma

TonyLeeVT
Builder

Do you have the Cylance app installed on your search heads? https://splunkbase.splunk.com/app/3233

Do you have the Cylance TA installed on your indexers? TA: https://splunkbase.splunk.com/app/3709/

0 Karma

itradeclayton
Path Finder

we no longer have cylance so it's a moot point for us... 🙂

0 Karma

meglin_splunk
Splunk Employee
Splunk Employee

It might be due to macros not replicating to the Indexers in the bundle. By default, macro config files do not get included.

Try adding the following to your distsearch.conf :

[replicationSettings:refineConf]

Replicate these specific *.conf files and their associated *.meta stanzas.

replicate.macros = true

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...