Security

How to share a macro globally within the context of my app configuration in macros.conf?

ShawnClark
Explorer

I have created a macro within an app using the macros.conf file. I am able to see the macro within the Settings -> Advanced Search -> Search Macros if I look under the context of my app. There is an option there under the "Sharing" heading to have it shared globally. What I am trying to figure out is how to set that setting within the macros.conf. I have set it to globally, but I don't see my macros.conf being updated with any additional setting and I don't see any other *.conf file being updated to show that setting. How do I go about setting that property from within the context of my app configuration?

0 Karma
1 Solution

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

View solution in original post

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

ShawnClark
Explorer

🙂 Thanks ... I found it shortly after posting. The settings for people that want to know specifically:

[macros/test-macro]
export = system
owner = nobody
version = 6.2.3
modtime = 1439323188.314901000

"test-macro" is the name of the macro. "export" of system is to share it globally.

0 Karma

somesoni2
Revered Legend

Adding to that, export = none is app level sharing (This app).
For private sharing permissiong, the .meta entries are available in /etc/users/UserName/AppName/metadata/local.meta and there is NO export attribute for private objects.

Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...