Archive

How come the comment "macro" is not working?

Communicator

I must be out of my mind. The comments built-in macro since version 6.5.0 gives me an error that it can't find the macro. I'm using the syntax found in the docs here, with my version of splunk in the url so it shows the one for my version.

https://docs.splunk.com/Documentation/Splunk/6.6.10/Search/Addcommentstosearches

index=* sourcetype=* `comment("THIS IS A COMMENT")`

this gives me an error

Error in 'SearchParser': The search specifies a macro 'comment' that cannot be found.

What could I be doing incorrectly?

Chris

1 Solution

Builder

For some reason the comment macro's sharing is set to "app" out of the box. You'll have to use a configuration package (app) or navigate to Settings>Advanced Search>Macros to update the permissions.

View solution in original post

Engager

Hi,
I am experiencing the same as Chris but I have investigated the macro properties of the Comment macro:
alt text
And I am going to use Comments in the service_iam_na application listed in the Permissions overview.

What is cause of my problem ?

,

0 Karma

Engager

My problem was resolved ! First issue:
'Everyone' had Read access to macro, doesn't mean that every Dashboard can use it...

You have to explicitly allow it to Read the Macro...in order for it to work.

0 Karma

Builder

For some reason the comment macro's sharing is set to "app" out of the box. You'll have to use a configuration package (app) or navigate to Settings>Advanced Search>Macros to update the permissions.

View solution in original post

Communicator

Thanks, now I see it, and it's set to app permissions. I'll work with our Splunk admins to update this.

Influencer

what version of splunk you are running? Also make sure you are running it in search app.

0 Karma

Communicator

i am on v 6.6.10. So I can't run this in all the apps with a search bar? it only works in search app? Everyone here uses their own department's app to segregate pci/phi/etc with permissions.

0 Karma

Influencer

Check macros.conf in search app , you can copy macro for comments in other app if you need it. Try if your search with comment macro is working on search app, check permissions and copy to other app if needed.

Communicator

thanks, i'll work with the splunk admins.

0 Karma