Splunk Macro cim_Alerts_indexes Error

[lucilleddajab]

Hi, we are using a Splunk Cloud ES and we can't seem to edit the base search macro of the "Alerts" datamodel. The macro in question is, " cim_Alerts_indexes" and it appears it has an extra parameter which generates an error when this macro is ran manually.

Error: "Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side"

And that is due to the fact that the macro SPL is set up as follows:

(index=(index=azure_security sourcetype="GraphSecurityAlert") OR (index=trendmicro))

The extra "index=" in the beginning is what's messing it up. It should be removed.

However, when we try to go to Settings -> Advanced Search and click on this macro, we are taken to the CIM Setup interface (Splunk_SA_CIM) which shows the config settings of the macro, including the:

Indexes whitelist = azure_security,trendmicro
Tags whitelist = cloud, pci

Notice, the editable configs do not include the definition which is:

(index=(index=azure_security sourcetype="GraphSecurityAlert") OR (index=trendmicro))

 
So can anyone assist how we can correct this?

Regards

[meetmshah]

Hello @grep, Can you please try removing whitelisting from the "CIM Setup" page and only have condition available from Macro page?

Let me know if it doesn't work and I can troubleshoot.

[dural_yyz]

You need a btool debug output for macros.conf on the ES SHC.  The app is reading the proper file but it appears you have some override of that stanza coming from and outside file.

[lucilleddajab]

Hi @dural_yyz,

Thanks for your response. I'm not sure if we can do btool as this is in Splunk Cloud ES.