All Apps and Add-ons

Where should we put Macro - TA or Main APP


Hi All,

I have created two apps TA and Main APP. My TA contains many search time extraction, event type and tagging. In order to allow end user capability to change index as required, I have used macro in all the dashboard queries. I had put macro in TA as Main app is dependent on TA. But when I uploaded TA and Main app on Splunk base for certification, they have raised a failure for Main app saying macro definition is unavailable. However this definition is present in the TA with global permission.

I just wanted to know where should I put macro? Should I create macros at multiple places TA and Main app or should I not use macro at all for Index selection.

Let me know the right approach.

0 Karma

Ultra Champion

I would have thought that a macro for indexes would be best placed in your main App.

Are you sure the issue was not with the permissions/config in your metadata/local.meta in the App?

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...