Reporting

why do i get an Error in 'SearchParser' when i try to save my search with macros in it?

piebob
Splunk Employee
Splunk Employee

i have a search that uses the following two macros, neither of which take arguments.

exclude_URIs_docs
uri!="/images/" uri!="/skins" uri!="/extensions*" uri!="/themes" uri!="favicon" uri!="/DocumentationStatic*asset*" uri!="/DocumentationStatic*resources*"

exclude_useragents_docs

useragent!="gsa*" useragent!="SplunkPinger*" useragent!=bot

the search runs fine, but when i try to save it, i get the following error:

Error in 'SearchParser': Could not find macro 'exclude_URIs_docs' that takes 0 arguments. Expecting stanza name 'exclude_URIs_docs'.

splunk hasn't been restarted since i created them, is this potentially the reason for the error?

0 Karma
1 Solution

lguinn2
Legend

When you save the search, are you selecting the option of sharing the search with others using the app? If yes, then the macros must also be shared.

If the macros are private, then Splunk will give an error message if you try to save the search as a shared search.

Try changing the permissions of the macros and then saving the search.

(Or I could be wrong, but I think I remember having this problem myself.)

View solution in original post

lguinn2
Legend

When you save the search, are you selecting the option of sharing the search with others using the app? If yes, then the macros must also be shared.

If the macros are private, then Splunk will give an error message if you try to save the search as a shared search.

Try changing the permissions of the macros and then saving the search.

(Or I could be wrong, but I think I remember having this problem myself.)

lguinn2
Legend

Yes, and it is also a lame error message.

0 Karma

piebob
Splunk Employee
Splunk Employee

yeah, i had chosen to make the saved search public to users of my app's context, but when i created the macros, they were private by default. this is kind of lame, since there's no way to set the permissions of a given macro in the "add new macro" page while you're making it. however, you can change these from the Manager » Advanced search » Search macros list page.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...