Splunk App for AWS: How do I resolve error "The search specifies a macro 'aws-description-instance' that cannot be found"?

[sankar74]

How do I resolve I following error?

Error in 'SearchParser': The search specifies a macro 'aws-description-instance' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information

[czhang_splunk · Accepted solution]

Hi Sankar74,

The Overview page has been updated on Splunk App for AWS - 4.1.1, which removed the usage of macro aws-description-instance.

I guess you have edited the Overview page when you have App 4.0.0 installed, is that correct? In that case there will be a copy of old Overview page under APP FOLDER/local/data/ui/views/overview.xml. You can make a copy of your old overview.xml and delete it. Then you will be available to view the latest Overview page.

Let me know if this solves your problem. Thanks!

[chwang_splunk]

Hi, Could you pls provide more information for this case? What's the scenario to get this error?

[sankar74]

When i launch the Splunk App for AWS, the overview page use to show me multiple panels with data. One of the tab is Comupte Instances Panel and other one is Security. These two panels the data was showing the above mention errors. Looks like that macro "aws-description-instance" is missing which is used in that panels.

[chwang_splunk]

Could you pls list your App & Add-on's version? Thanks a lot.

[kuljeetss]

I had the same issue with the app after upgrade. I followed these steps and it is working fine now. Thanks chwang 🙂

[sankar74]

Splunk App for AWS - 4.1.1
Splunk Addon for AWS - 3.0.0