Security

How to share a macro globally within the context of my app configuration in macros.conf?

ShawnClark
Explorer

I have created a macro within an app using the macros.conf file. I am able to see the macro within the Settings -> Advanced Search -> Search Macros if I look under the context of my app. There is an option there under the "Sharing" heading to have it shared globally. What I am trying to figure out is how to set that setting within the macros.conf. I have set it to globally, but I don't see my macros.conf being updated with any additional setting and I don't see any other *.conf file being updated to show that setting. How do I go about setting that property from within the context of my app configuration?

0 Karma
1 Solution

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

View solution in original post

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

ShawnClark
Explorer

🙂 Thanks ... I found it shortly after posting. The settings for people that want to know specifically:

[macros/test-macro]
export = system
owner = nobody
version = 6.2.3
modtime = 1439323188.314901000

"test-macro" is the name of the macro. "export" of system is to share it globally.

somesoni2
Revered Legend

Adding to that, export = none is app level sharing (This app).
For private sharing permissiong, the .meta entries are available in /etc/users/UserName/AppName/metadata/local.meta and there is NO export attribute for private objects.

Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...