I created a Macro with name auth(1), app is ES, argument is src and the definition is
| from datamodel:"Authentication"."Authentication" | search (src="$src$" OR Authentication.src="$src$" OR dest="$src$" OR Authentication.dest="$src$") | eval username=user_first+" "+user_last | eval phone=if(isnull(user_phone), user_phone2, user_phone) | rename user_managedBy as userid, user_email as email, WorkstationName as workstation | fields username, email, userid, phone, workstation
And I am trying to call this Macro in a ES search as
sourcetype=*someexamplesourcetype* auth(src) and this didn't work
I also tried like sourcetype=*someexamplesourcetype* auth("10.20.30.40") and this didn't work too sourcetype=*someexamplesourcetype* auth(1) and this didn't work too
When I try like
sourcetype=*someexamplesourcetype* auth I am getting error message as
Error in 'SearchParser': The search specifies a macro 'auth' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.
Note There are backticks in front of auth and auth(src) as you know this will be converted to code format I removed backticks in this question.
I assigned the Macro access to global with read & write for everyone, still the error message appears.