All Apps and Add-ons

Error with macros in the search of the ES Content Update app

socverne
Explorer

Good Morning.

We are using the "ES Content Updates" app. And when executing the searches that it incorporates, it always throws us the same error. For example:

"ESCU - Common Ransomware Extensions - Rule"

Search:
| tstats summariesonly count min (_time) as firstTime max (_time) as lastTime values ​​(Filesystem.user) as user values ​​(Filesystem.dest) as dest values ​​(Filesystem.file_path) as file_path from datamodel = Endpoint.Filesystem by Filesystem. file_name | drop_dm_object_name (Filesystem) | ctime (lastTime) | ctime (firstTime) | rex field = file_name "(? . [^ .] +) $" | ransomware_extensions

Error:
Error in 'SearchParser': The search specifies a macro 'summariesonly' that can not be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

We have made several checks and we do not have the macros 'summariesonly' and 'ctime'. Can help us? Should we make more changes in the search? Thank you.

A greeting.

0 Karma

Laszlo_K
Explorer

I guess you had installed ES before using ESCU.
Both macros comes with app SA-Utils (for ex. with ES version 5.2.0).

macro summariesonly can be replaced with this: summariesonly= true | false allow_old_summaries= true | false (true or false depending on your datamodel acceleration settings, see in tstats parameters in Splunk docs).
macro ctime simply converts an epoch time to an ascii human readable time, so use convert with a proper time format (see example in Splunk docs).

0 Karma

socverne
Explorer

Thank you very much for the help.

We have solved the macro "summariesonly" but we do not know how to create the macro "ctime". When we execute the same search, now it throws us the following error:

"Error in 'SearchParser': The search specifies a macro 'ctime' that can not be found. Reasons include: the macro name is misspelled, you do not have" read "permission for the macro, or the macro has not been shared with this application, Click Settings, Advanced search, Search Macros to view macro information. "

We do not find in the network anything about this macro or what content it may have, can you help us? Thank you.

A greeting.

0 Karma

Laszlo_K
Explorer

That would be for example :

| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(firstTime)
| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(lastTime)

I'm curious if the | "ransomware_extension" macro will be found and executed...

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...