Why editing Macros is throwing an error?

[davebg]

Apologies, but I am new to Splunk and am looking for a little bit of guidance/help.

I am having an issue with one of our apps. 

For whatever reason when I try going AdvancedSearch/Macros from with the Network app, the url changes to /data/macros and I get a 404 error.

However, if I manually change it to /admin/macros, I can get in just fine and edit/view macros.

It is only happening under one specific app. Other apps are able to use /data/macros just fine. 

I think it might be permission related, but I am unsure where to check or what to look for. 

It is like this older thread, but I'm not sure where to start looking: https://community.splunk.com/t5/Knowledge-Management/Editing-macro-is-giving-a-404-error/m-p/433712/... 

[gcusello]

Hi @davebg,

probably the issue is that that macro is still private.

Try to share it al App or Global level and you'll find macros.conf file  in the $SPLUNK_HOME/etc/apps/<your-app>/local folder.

Ciao.

Giuseppe