Security

What configuration do I need to change for users other than admin to use a macro?

imanpoeiri
Communicator

Hi Experts,

I use the following macro, and it works perfectly fine with admin role until I created new users (with limited capabilities of course) and I noticed it does not work for them. Any clue what capabilities that I should enable for other users to use the macro?

Sample macro

[macro_number_one(1)]
args = type
definition = case("$type$"="main", "index=some_index_01", "$type$"="itsm", "index=some_index_01", 1=1, "index=some_index_01")
iseval = 1

results are only displaying the macro name on the panel:

macro_number_one
0 Karma

jeffland
SplunkTrust
SplunkTrust

Did you check the permission on the macro? If it's private for admin, no other user will be able to use it (unless it has admin capabilities).

imanpoeiri
Communicator

Hi @jeffland,

Do you mind to share with me how to check macro.prop whether under admin or other users? Because as far as I know, it just a file and I drop it on application's default folder.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Well usually you can just check and edit such things via the gui, via Settings - Advanced Search - Search Macros. But if you placed it in the default folder, then the macro can't be private - so it has to be another reason.
Have you tried creating the macro from the gui and setting its permissions to app or global level?

0 Karma

imanpoeiri
Communicator

Hi @jeffland,

Still no luck even after I create it via GUI, however if I inherit the role from admin it working fine! I suspect one of the capabilities need to be applied but not sure which capabilities.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Which capabilites does the user have (both itself and inherited)? Every role needs to have at least rest_properties_get and search to be useful. I just created a role with these two capabilites, assigned a user that role and was able to use a macro which I created with app-level permission for as that new user. There's no capability needed to use macros.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...