The search specifies a macro that cannot be found

[Roy_9]

Hello,

I am seeing the below error in the internal logs, I am on Splunk On premise clustered environment.

10-03-2023 23:48:50.697 +0000 ERROR SearchParser [110001 TcpChannelThread] - The search specifies a macro 'get_tenable_sourcetype' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

How do i need to get rid of this error from our internal logs.

I have checked under Macros and all configurations and I dont see this macro.

But inside the TA-tenable/local/macros.conf i see only 

[get_tenable_index]
definition = (index=abc)
iseval = 0

Please help me with your thoughts.

Thanks

[inventsekar]

so, you are having the macro.. 'get_tenable_index' 

and some search queries are using the macro 'get_tenable_sourcetype'

so, please try to find out the search query/report/alert/dashboard which is using the macro 'get_tenable_sourcetype' and edit/update that one. that should help you to remove all these internal errors. 

[Roy_9]

Thanks for your response @inventsekar 

Yes i have identified the dashboards and updated those by removing the get_tenable_sourcetype but i am still seeing these errors. I have updated those from GUI.

[inventsekar]

>>> Yes i have identified the dashboards and updated those by removing the get_tenable_sourcetype but i am still seeing these errors.

did you select the correct timepicker? (i mean, if you edited just within last 30 mins ago.. search the internal logs only for last 20 or 25 mins).. 

is it a production system? do you have any weekly service restarts?

upvotes / Karma points are appreciated by everybody, thanks. 

[Roy_9]

yes i have updated the dashboards this afternoon but i am still seeing the errors till now but the errors are showing up exactly at 30 min interval.

Does this change needs a rolling restart on SHC? yes this is a production Search head

[inventsekar]

i am not sure of whether this requires restart or not.. 

just give it some more time... 

also this internal errors are not a big issue.. it can wait. it wont impact splunk indexing and searching/performance.. so no need to worry much. 

if you are having a service restart within two/three weeks or within a month, you can wait until that service restart and then verify this one. hope you understood .. thanks. 

[Roy_9]

@inventsekar I will schedule a restart and will keep you posted on the errors.

Thank you