All Apps and Add-ons
Highlighted

CylancePROTECT App for Splunk: Why is Macro broken in my distributed environment?

Path Finder

After this last update, my searches no longer work because the eventtype search fails. The cylance_index macro doesn't seem to be replicating to the indexers and I get these errors:

[xxxINDEXERSERVERNAMExxx] Error in 'SearchParser': The search specifies a macro 'cylance_index' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I'm not certain yet how to get this to replicate from my search heads (not clustered) to my indexers (clustered).

0 Karma
Highlighted

Re: CylancePROTECT App for Splunk: Why is Macro broken in my distributed environment?

Splunk Employee
Splunk Employee

It might be due to macros not replicating to the Indexers in the bundle. By default, macro config files do not get included.

Try adding the following to your distsearch.conf :

[replicationSettings:refineConf]

Replicate these specific *.conf files and their associated *.meta stanzas.

replicate.macros = true

0 Karma
Highlighted

Re: CylancePROTECT App for Splunk: Why is Macro broken in my distributed environment?

Builder

Do you have the Cylance app installed on your search heads? https://splunkbase.splunk.com/app/3233

Do you have the Cylance TA installed on your indexers? TA: https://splunkbase.splunk.com/app/3709/

0 Karma
Highlighted

Re: CylancePROTECT App for Splunk: Why is Macro broken in my distributed environment?

Path Finder

we no longer have cylance so it's a moot point for us... 🙂

0 Karma