Security

How to share a macro globally within the context of my app configuration in macros.conf?

ShawnClark
Explorer

I have created a macro within an app using the macros.conf file. I am able to see the macro within the Settings -> Advanced Search -> Search Macros if I look under the context of my app. There is an option there under the "Sharing" heading to have it shared globally. What I am trying to figure out is how to set that setting within the macros.conf. I have set it to globally, but I don't see my macros.conf being updated with any additional setting and I don't see any other *.conf file being updated to show that setting. How do I go about setting that property from within the context of my app configuration?

0 Karma
1 Solution

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

View solution in original post

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

ShawnClark
Explorer

🙂 Thanks ... I found it shortly after posting. The settings for people that want to know specifically:

[macros/test-macro]
export = system
owner = nobody
version = 6.2.3
modtime = 1439323188.314901000

"test-macro" is the name of the macro. "export" of system is to share it globally.

somesoni2
Revered Legend

Adding to that, export = none is app level sharing (This app).
For private sharing permissiong, the .meta entries are available in /etc/users/UserName/AppName/metadata/local.meta and there is NO export attribute for private objects.

Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...