All Apps and Add-ons

CylancePROTECT App for Splunk: Why is Macro broken in my distributed environment?

Path Finder

After this last update, my searches no longer work because the eventtype search fails. The cylance_index macro doesn't seem to be replicating to the indexers and I get these errors:

[xxxINDEXER_SERVER_NAMExxx] Error in 'SearchParser': The search specifies a macro 'cylance_index' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I'm not certain yet how to get this to replicate from my search heads (not clustered) to my indexers (clustered).

0 Karma

Builder

Do you have the Cylance app installed on your search heads? https://splunkbase.splunk.com/app/3233

Do you have the Cylance TA installed on your indexers? TA: https://splunkbase.splunk.com/app/3709/

0 Karma

Path Finder

we no longer have cylance so it's a moot point for us... 🙂

0 Karma

Splunk Employee
Splunk Employee

It might be due to macros not replicating to the Indexers in the bundle. By default, macro config files do not get included.

Try adding the following to your distsearch.conf :

[replicationSettings:refineConf]

Replicate these specific *.conf files and their associated *.meta stanzas.

replicate.macros = true

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!