Security

How to share a macro globally within the context of my app configuration in macros.conf?

ShawnClark
Explorer

I have created a macro within an app using the macros.conf file. I am able to see the macro within the Settings -> Advanced Search -> Search Macros if I look under the context of my app. There is an option there under the "Sharing" heading to have it shared globally. What I am trying to figure out is how to set that setting within the macros.conf. I have set it to globally, but I don't see my macros.conf being updated with any additional setting and I don't see any other *.conf file being updated to show that setting. How do I go about setting that property from within the context of my app configuration?

0 Karma
1 Solution

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

View solution in original post

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

ShawnClark
Explorer

🙂 Thanks ... I found it shortly after posting. The settings for people that want to know specifically:

[macros/test-macro]
export = system
owner = nobody
version = 6.2.3
modtime = 1439323188.314901000

"test-macro" is the name of the macro. "export" of system is to share it globally.

0 Karma

somesoni2
Revered Legend

Adding to that, export = none is app level sharing (This app).
For private sharing permissiong, the .meta entries are available in /etc/users/UserName/AppName/metadata/local.meta and there is NO export attribute for private objects.

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...