Security

How to share a macro globally within the context of my app configuration in macros.conf?

ShawnClark
Explorer

I have created a macro within an app using the macros.conf file. I am able to see the macro within the Settings -> Advanced Search -> Search Macros if I look under the context of my app. There is an option there under the "Sharing" heading to have it shared globally. What I am trying to figure out is how to set that setting within the macros.conf. I have set it to globally, but I don't see my macros.conf being updated with any additional setting and I don't see any other *.conf file being updated to show that setting. How do I go about setting that property from within the context of my app configuration?

0 Karma
1 Solution

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

View solution in original post

somesoni2
Revered Legend

The sharing permission is managed in the .meta files. Under your app, you should be seeing the folder called metadata (/etc/apps/YourApp/metadata) containing two files default.meta and local.meta. Any changes to sharing permission would be noted in the local.meta file.

ShawnClark
Explorer

🙂 Thanks ... I found it shortly after posting. The settings for people that want to know specifically:

[macros/test-macro]
export = system
owner = nobody
version = 6.2.3
modtime = 1439323188.314901000

"test-macro" is the name of the macro. "export" of system is to share it globally.

somesoni2
Revered Legend

Adding to that, export = none is app level sharing (This app).
For private sharing permissiong, the .meta entries are available in /etc/users/UserName/AppName/metadata/local.meta and there is NO export attribute for private objects.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...