All Apps and Add-ons

Error with macros in the search of the ES Content Update app

socverne
Explorer

Good Morning.

We are using the "ES Content Updates" app. And when executing the searches that it incorporates, it always throws us the same error. For example:

"ESCU - Common Ransomware Extensions - Rule"

Search:
| tstats summariesonly count min (_time) as firstTime max (_time) as lastTime values ​​(Filesystem.user) as user values ​​(Filesystem.dest) as dest values ​​(Filesystem.file_path) as file_path from datamodel = Endpoint.Filesystem by Filesystem. file_name | drop_dm_object_name (Filesystem) | ctime (lastTime) | ctime (firstTime) | rex field = file_name "(? . [^ .] +) $" | ransomware_extensions

Error:
Error in 'SearchParser': The search specifies a macro 'summariesonly' that can not be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

We have made several checks and we do not have the macros 'summariesonly' and 'ctime'. Can help us? Should we make more changes in the search? Thank you.

A greeting.

0 Karma

Laszlo_K
Explorer

I guess you had installed ES before using ESCU.
Both macros comes with app SA-Utils (for ex. with ES version 5.2.0).

macro summariesonly can be replaced with this: summariesonly= true | false allow_old_summaries= true | false (true or false depending on your datamodel acceleration settings, see in tstats parameters in Splunk docs).
macro ctime simply converts an epoch time to an ascii human readable time, so use convert with a proper time format (see example in Splunk docs).

0 Karma

socverne
Explorer

Thank you very much for the help.

We have solved the macro "summariesonly" but we do not know how to create the macro "ctime". When we execute the same search, now it throws us the following error:

"Error in 'SearchParser': The search specifies a macro 'ctime' that can not be found. Reasons include: the macro name is misspelled, you do not have" read "permission for the macro, or the macro has not been shared with this application, Click Settings, Advanced search, Search Macros to view macro information. "

We do not find in the network anything about this macro or what content it may have, can you help us? Thank you.

A greeting.

0 Karma

Laszlo_K
Explorer

That would be for example :

| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(firstTime)
| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(lastTime)

I'm curious if the | "ransomware_extension" macro will be found and executed...

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...