All Apps and Add-ons

Where should we put Macro - TA or Main APP

hardikJsheth
Motivator

Hi All,

I have created two apps TA and Main APP. My TA contains many search time extraction, event type and tagging. In order to allow end user capability to change index as required, I have used macro in all the dashboard queries. I had put macro in TA as Main app is dependent on TA. But when I uploaded TA and Main app on Splunk base for certification, they have raised a failure for Main app saying macro definition is unavailable. However this definition is present in the TA with global permission.

I just wanted to know where should I put macro? Should I create macros at multiple places TA and Main app or should I not use macro at all for Index selection.

Let me know the right approach.

0 Karma

nickhills
Ultra Champion

I would have thought that a macro for indexes would be best placed in your main App.

Are you sure the issue was not with the permissions/config in your metadata/local.meta in the App?

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...