I have an app X configured in a search head and there are some x,y,z macros created in Splunk Web. Now I want to open the macros.conf on the backend.
What is the possible path to find the macros.conf?
Is there any grep command to search for macros.conf in $Splunk_Home directory?
Can I find it in search head or indexer?
If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf
If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf
View solution in original post