Error with macros in the search of the ES Content Update app

[socverne]

Good Morning.

We are using the "ES Content Updates" app. And when executing the searches that it incorporates, it always throws us the same error. For example:

"ESCU - Common Ransomware Extensions - Rule"

Search:
| tstats summariesonly count min (_time) as firstTime max (_time) as lastTime values ​​(Filesystem.user) as user values ​​(Filesystem.dest) as dest values ​​(Filesystem.file_path) as file_path from datamodel = Endpoint.Filesystem by Filesystem. file_name | drop_dm_object_name (Filesystem) | ctime (lastTime) | ctime (firstTime) | rex field = file_name "(? . [^ .] +) $" | ransomware_extensions

Error:
Error in 'SearchParser': The search specifies a macro 'summariesonly' that can not be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

We have made several checks and we do not have the macros 'summariesonly' and 'ctime'. Can help us? Should we make more changes in the search? Thank you.

A greeting.

[Laszlo_K]

I guess you had installed ES before using ESCU.
Both macros comes with app SA-Utils (for ex. with ES version 5.2.0).

macro summariesonly can be replaced with this: summariesonly= true | false allow_old_summaries= true | false (true or false depending on your datamodel acceleration settings, see in tstats parameters in Splunk docs).
macro ctime simply converts an epoch time to an ascii human readable time, so use convert with a proper time format (see example in Splunk docs).

[socverne]

Thank you very much for the help.

We have solved the macro "summariesonly" but we do not know how to create the macro "ctime". When we execute the same search, now it throws us the following error:

"Error in 'SearchParser': The search specifies a macro 'ctime' that can not be found. Reasons include: the macro name is misspelled, you do not have" read "permission for the macro, or the macro has not been shared with this application, Click Settings, Advanced search, Search Macros to view macro information. "

We do not find in the network anything about this macro or what content it may have, can you help us? Thank you.

A greeting.

[Laszlo_K]

That would be for example :

| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(firstTime)
| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(lastTime)

I'm curious if the | "ransomware_extension" macro will be found and executed...