All Apps and Add-ons

CylancePROTECT App for Splunk: Why is Macro broken in my distributed environment?

itradeclayton
Path Finder

After this last update, my searches no longer work because the eventtype search fails. The cylance_index macro doesn't seem to be replicating to the indexers and I get these errors:

[xxxINDEXER_SERVER_NAMExxx] Error in 'SearchParser': The search specifies a macro 'cylance_index' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I'm not certain yet how to get this to replicate from my search heads (not clustered) to my indexers (clustered).

0 Karma

TonyLeeVT
Builder

Do you have the Cylance app installed on your search heads? https://splunkbase.splunk.com/app/3233

Do you have the Cylance TA installed on your indexers? TA: https://splunkbase.splunk.com/app/3709/

0 Karma

itradeclayton
Path Finder

we no longer have cylance so it's a moot point for us... 🙂

0 Karma

meglin_splunk
Splunk Employee
Splunk Employee

It might be due to macros not replicating to the Indexers in the bundle. By default, macro config files do not get included.

Try adding the following to your distsearch.conf :

[replicationSettings:refineConf]

Replicate these specific *.conf files and their associated *.meta stanzas.

replicate.macros = true

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>