How do you use macros in event types on distributed/cluster environments?

[kaumiladani]

I've got a macro that contains 'sourcetype' and 'index' in search(both of which could be changed from client side).

The macro is being used in different eventtypes for dashboard queries.

On installing the app and TA on a distributed/cluster environment (Splunk v7.2.*), the search using eventtype gives the following error:

Streamed search execute failed because Error in 'SearchParser': The search specifies a macro '[NAME OF THE MACRO]' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

All the permission for macro, app and TA are defined as per Splunk standards.
I tried using distsearch.conf file but with no help.

[kamlesh_vaghela · Accepted solution]

@kaumiladani

With your all configurations, you have to add macros permission on default.meta also. Can you please try and let me know.

[replicationSettings:refineConf]

replicate.<conf_file_name> = <bool>
* Controls whether Splunk replicates a particular type of *.conf file, along
  with any associated permissions in *.meta files.
* These settings on their own do not cause files to be replicated. A file must
  still be whitelisted (via replicationWhitelist) to be eligible for inclusion
  via these settings.

* In a sense, these settings constitute another level of filtering that applies
  specifically to *.conf files and stanzas with *.meta files.
* Defaults to: false

https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/Distsearchconf#

[kaumiladani]

Thanks, it works now.

[prakash007]

@kaumiladani : by default macros are not distributed to indexers in a clustered environment, did you try adding this stanza in your apps/TA's: default/distsearch.conf

[replicationSettings:refineConf]
replicate.macros = true

OR you can get rid of macros from event types, and create a local copy.
https://answers.splunk.com/answers/661233/error-searchparser-the-search-specifies-a-macro-cs.html

[kaumiladani]

@prakash007 Thanks for the quick response.
Yes, the distsearch.conf with replication settings as well as whitelist settings has been already tried but the issue persists.

Also, removing macro from eventtype is not possible as there are lots of eventtype and my macro is of the format:

definition = index="xyz_events" AND sourcetype="name_of_the_sourcetype"

both of which configurable from client side. Change in either of them would result in change at multiple instances.