why do i get an Error in 'SearchParser' when i try to save my search with macros in it?

[piebob]

i have a search that uses the following two macros, neither of which take arguments.

exclude_URIs_docs
uri!="/images/" uri!="/skins" uri!="/extensions*" uri!="/themes" uri!="favicon" uri!="/DocumentationStatic*asset*" uri!="/DocumentationStatic*resources*"

exclude_useragents_docs

useragent!="gsa*" useragent!="SplunkPinger*" useragent!=bot

the search runs fine, but when i try to save it, i get the following error:

Error in 'SearchParser': Could not find macro 'exclude_URIs_docs' that takes 0 arguments. Expecting stanza name 'exclude_URIs_docs'.

splunk hasn't been restarted since i created them, is this potentially the reason for the error?

[lguinn2 · Accepted solution]

When you save the search, are you selecting the option of sharing the search with others using the app? If yes, then the macros must also be shared.

If the macros are private, then Splunk will give an error message if you try to save the search as a shared search.

Try changing the permissions of the macros and then saving the search.

(Or I could be wrong, but I think I remember having this problem myself.)

[lguinn2]

Yes, and it is also a lame error message.

[piebob]

yeah, i had chosen to make the saved search public to users of my app's context, but when i created the macros, they were private by default. this is kind of lame, since there's no way to set the permissions of a given macro in the "add new macro" page while you're making it. however, you can change these from the Manager » Advanced search » Search macros list page.