All Apps and Add-ons

Where should we put Macro - TA or Main APP


Hi All,

I have created two apps TA and Main APP. My TA contains many search time extraction, event type and tagging. In order to allow end user capability to change index as required, I have used macro in all the dashboard queries. I had put macro in TA as Main app is dependent on TA. But when I uploaded TA and Main app on Splunk base for certification, they have raised a failure for Main app saying macro definition is unavailable. However this definition is present in the TA with global permission.

I just wanted to know where should I put macro? Should I create macros at multiple places TA and Main app or should I not use macro at all for Index selection.

Let me know the right approach.

0 Karma

Ultra Champion

I would have thought that a macro for indexes would be best placed in your main App.

Are you sure the issue was not with the permissions/config in your metadata/local.meta in the App?

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...

Observability Cloud | AWS PrivateLink Enabled for Splunk Observability Cloud

We’ve enabled AWS PrivateLink for Observability Cloud, giving you an additional inbound connection to send ...

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...