migration

[SN1]

so i copied enterprise security app folder from old sh to new but it is showing macro error not found where i can find the macro of this app and how to migrate them also.

[livehybrid]

Hi @SN1 

I would recommend running the following on our old SH to find out where the macro is easily:

/opt/splunk/bin/splunk btool macros list MacroName --debug

Replace MacroName with the name of your missing macro - this should output a the configuration of the macro and include the path that the macro resides in.

If you still do not see the macro there then it could be a private Knowledge Object. Did you copy you user's custom data from /opt/splunk/etc/users aswell? Did you copy all the apps from the old SH to the new SH?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[kiran_panchavat]

@SN1When migrating from an old search head to a new one, it's essential to ensure that all configurations, including macros, are correctly transferred. However, if you're encountering issues such as missing macros after the migration, it indicates that some components may not have been properly moved. To address this, I recommend reaching out to Splunk Support for personalized assistance.

[gcusello]

Hi @kiran_panchavat ,

adding a bit of information the the perfect answer of @kiran_panchavat:

it's always a best practice to save all the customizations that you did in ES in a custom app, e.g. custom field extractions, custom correlation searches or dashboards or reports, or, as in your case, macros: don't leave anything custom in the Enterprise Security (and the other module) app.

Ciao.

Giuseppe

[kiran_panchavat]

@SN1 

Locate Macros in the Old Search Head

From the Splunk UI:

• Navigate to Settings > Advanced Search > Search Macros