Security

After creating macros in Splunk Web on a search head, where do I find the path for macros.conf?

pavanae
Builder

I have an app X configured in a search head and there are some x,y,z macros created in Splunk Web. Now I want to open the macros.conf on the backend.

What is the possible path to find the macros.conf?

Is there any grep command to search for macros.conf in $Splunk_Home directory?

Can I find it in search head or indexer?

1 Solution

somesoni2
SplunkTrust
SplunkTrust

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...