Hey All,
Finishing the configuration and tuning of the Microsoft 365 App for Splunk and on the overview dashboard under M365 a single panel is having an issue with a macro.
Error message:
Error in 'SearchParser': The search specifies a macro 'o365_service_status' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.
I checked the app's default and local folders and in the GUI and don't even see this macro anywhere.
Anyone have any clue what this macro holds so that I can create it to get this dashboard panel working?
Thanks,
Andrew
