Why does the search specifies a macro 'fidelis_get_xps_event' cannot be found?

[dyeo]

In our environment we have 3 separate non-distributed search heads and a 3-clustered indexers. When I try running the following search:

(`cim_Malware_indexes`) tag=malware tag=attack

I receive the following search error message:

3 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.

[indexer01] Streamed search execute failed because: Error in 'SearchParser': The search specifies a macro 'fidelis_get_xps_event' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

[indexer02] Streamed search execute failed because: Error in 'SearchParser': The search specifies a macro 'fidelis_get_xps_event' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

[indexer03] Streamed search execute failed because: Error in 'SearchParser': The search specifies a macro 'fidelis_get_xps_event' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I'm not sure why the macro would need to be on the indexers, but does fidelis_get_xps_event macro need to be replicated to the indexers?

[responsys_cm]

I experienced a similar problem. When I tried to search two datamodels, I got the error that the macro was missing. It turned out that there was a tags.conf file that applied the tags for the two different datamodels, but there was no corresponding eventtypes.conf file that was applying those tags. When I removed the tags.conf file, the problem went away.

[woodcock]

Try using SHIFT-CTRL-E to expand through layers of macros to see where that macro is being pulled in.

[jagadeeshreddy2]

Please check the permissions for your macro "fidelis_get_xps_event".

There is a case if the macro is not shared with "All apps" and if you are trying to use the macro somewhere in another application then you will get the Error in SearchParser.

Settings » Advanced search » Search macros » » Permissions

Change the Permission of macro to All apps.

[kamlesh_vaghela · Accepted solution]

Hi @dyeo,

I think macros are not getting replicating to the indexer. Can you please execute below troubleshooting step?

1) Can you please create a below file in Search Head?

$SPLUNK_HOME$/etc/app/TA-Fidelis-Analytics/default/distsearch.conf

[replicationSettings:refineConf]
replicate.macros = true

2) Restart Splunk.

Please refer: https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Distsearchconf

Thanks

[dyeo]

This appears to have resolved it. Thanks kamlesh_vaghela!

[wsmworkhard]

Resolved my issue as well.

Thank you!

[kamlesh_vaghela]

@dyeo
Glad to help you.