Getting Data In

How do use the Splunk REST API to update macros that live under a different app?

starbuck
New Member

Hiya, I'm trying to use the Splunk REST API to update macros that I've recently had to move to live under a different app that isn't the default `search` app.

Before when the macro lived in the `search` app I was able to make a POST request to 

 

/servicesNS/<account>/search/admin/macros/<macroName>

 

And this worked:

 

elif search_or_macro == 'macros':
    url = '<ROOT>/servicesNS/<ACCOUNT>/search/admin/macros/{}'.format(macro_name)
    res = requests.post(url, headers=headers, data={'definition': r'{}'.format(macro_definition)})

 


However once I moved the macros to live under a new app, let's call it `my_new_app`, POST requests no longer work to update the macro. This is what I have currently:

 

elif search_or_macro == 'macros':
  url = '<ROOT>/servicesNS/nobody/my_new_app/admin/macros/{}'.format(macro_name)
  res = requests.post(url, headers=headers, data={'definition': r'{}'.format(macro_definition)})

 

I have tried replacing `nobody` with:

  • admin
  • the account that owns the macro

However neither of these work.

I used the following splunk command to verify that the endpoint does seem to exist:

 

| rest /servicesNS/<ACCOUNT>/my_new_app/admin/macros/<MACRO NAME>
| search author=<ACCOUNT>

 

And when I run that I get the following `id`:

 

https://127.0.0.1:8089/servicesNS/nobody/my_new_app/admin/macros/<MACRO NAME>

 

 
I have also read through the REST API documentation here:

However none of these explicitly describe how to update macros, and all I can seem to find when googling are old posts from 2015-2019 that weren't applicable to what I am trying to achieve

Any help here would greatly be appreciated, I feel like I'm missing something simple but can't find further documentation that applies to macros

0 Karma

deepakc
Builder

Check some of the app permissions settings using the below, this may help troubleshoot - it sounds like a permissions issue.

 

| rest splunk_server=local servicesNS/nobody/search/configs/conf-macros
| search eai:acl.app=my_new_app
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...