Macro API not working! - Splunk Community

Knowledge Management

Hello, I am attempting to Splunk search via Macro.

When using the Splunk search UI, the relevant information comes up, however, despite using the same user, the API search doesn’t get the same results

after further investigation, when looking for the Macro on the website I can see it, but not via the API.

What could be causing this?

Hi @lionkesler ... maybe you should update us some more details pls..

provide us the full SPL search query pls.. is the macro's working previously or just recently you found out this issue..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

Get Updates on the Splunk Community!

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...