Security

What configuration do I need to change for users other than admin to use a macro?

imanpoeiri
Communicator

Hi Experts,

I use the following macro, and it works perfectly fine with admin role until I created new users (with limited capabilities of course) and I noticed it does not work for them. Any clue what capabilities that I should enable for other users to use the macro?

Sample macro

[macro_number_one(1)]
args = type
definition = case("$type$"="main", "index=some_index_01", "$type$"="itsm", "index=some_index_01", 1=1, "index=some_index_01")
iseval = 1

results are only displaying the macro name on the panel:

macro_number_one
0 Karma

jeffland
SplunkTrust
SplunkTrust

Did you check the permission on the macro? If it's private for admin, no other user will be able to use it (unless it has admin capabilities).

imanpoeiri
Communicator

Hi @jeffland,

Do you mind to share with me how to check macro.prop whether under admin or other users? Because as far as I know, it just a file and I drop it on application's default folder.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Well usually you can just check and edit such things via the gui, via Settings - Advanced Search - Search Macros. But if you placed it in the default folder, then the macro can't be private - so it has to be another reason.
Have you tried creating the macro from the gui and setting its permissions to app or global level?

0 Karma

imanpoeiri
Communicator

Hi @jeffland,

Still no luck even after I create it via GUI, however if I inherit the role from admin it working fine! I suspect one of the capabilities need to be applied but not sure which capabilities.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Which capabilites does the user have (both itself and inherited)? Every role needs to have at least rest_properties_get and search to be useful. I just created a role with these two capabilites, assigned a user that role and was able to use a macro which I created with app-level permission for as that new user. There's no capability needed to use macros.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...