Reporting

why do i get an Error in 'SearchParser' when i try to save my search with macros in it?

Splunk Employee
Splunk Employee

i have a search that uses the following two macros, neither of which take arguments.

excludeURIsdocs
uri!="/images/" uri!="/skins" uri!="/extensions" uri!="/themes" uri!="favicon" uri!="/DocumentationStaticasset" uri!="/DocumentationStaticresources*"

excludeuseragentsdocs

useragent!="gsa" useragent!="SplunkPinger" useragent!=bot

the search runs fine, but when i try to save it, i get the following error:

Error in 'SearchParser': Could not find macro 'excludeURIsdocs' that takes 0 arguments. Expecting stanza name 'excludeURIsdocs'.

splunk hasn't been restarted since i created them, is this potentially the reason for the error?

0 Karma
1 Solution

Legend

When you save the search, are you selecting the option of sharing the search with others using the app? If yes, then the macros must also be shared.

If the macros are private, then Splunk will give an error message if you try to save the search as a shared search.

Try changing the permissions of the macros and then saving the search.

(Or I could be wrong, but I think I remember having this problem myself.)

View solution in original post

Legend

When you save the search, are you selecting the option of sharing the search with others using the app? If yes, then the macros must also be shared.

If the macros are private, then Splunk will give an error message if you try to save the search as a shared search.

Try changing the permissions of the macros and then saving the search.

(Or I could be wrong, but I think I remember having this problem myself.)

View solution in original post

Legend

Yes, and it is also a lame error message.

0 Karma

Splunk Employee
Splunk Employee

yeah, i had chosen to make the saved search public to users of my app's context, but when i created the macros, they were private by default. this is kind of lame, since there's no way to set the permissions of a given macro in the "add new macro" page while you're making it. however, you can change these from the Manager » Advanced search » Search macros list page.