Splunk Enterprise Security

Why does the search specifies a macro 'fidelis_get_xps_event' cannot be found?

dyeo
Engager

In our environment we have 3 separate non-distributed search heads and a 3-clustered indexers. When I try running the following search:

(`cim_Malware_indexes`) tag=malware tag=attack

I receive the following search error message:

3 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.

[indexer01] Streamed search execute failed because: Error in 'SearchParser': The search specifies a macro 'fidelis_get_xps_event' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

[indexer02] Streamed search execute failed because: Error in 'SearchParser': The search specifies a macro 'fidelis_get_xps_event' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

[indexer03] Streamed search execute failed because: Error in 'SearchParser': The search specifies a macro 'fidelis_get_xps_event' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I'm not sure why the macro would need to be on the indexers, but does fidelis_get_xps_event macro need to be replicated to the indexers?

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @dyeo,

I think macros are not getting replicating to the indexer. Can you please execute below troubleshooting step?

1) Can you please create a below file in Search Head?

$SPLUNK_HOME$/etc/app/TA-Fidelis-Analytics/default/distsearch.conf

[replicationSettings:refineConf]
replicate.macros = true

2) Restart Splunk.

Please refer: https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Distsearchconf

Thanks

View solution in original post

responsys_cm
Builder

I experienced a similar problem. When I tried to search two datamodels, I got the error that the macro was missing. It turned out that there was a tags.conf file that applied the tags for the two different datamodels, but there was no corresponding eventtypes.conf file that was applying those tags. When I removed the tags.conf file, the problem went away.

0 Karma

woodcock
Esteemed Legend

Try using SHIFT-CTRL-E to expand through layers of macros to see where that macro is being pulled in.

0 Karma

jagadeeshreddy2
Explorer

Please check the permissions for your macro "fidelis_get_xps_event".

There is a case if the macro is not shared with "All apps" and if you are trying to use the macro somewhere in another application then you will get the Error in SearchParser.

Settings » Advanced search » Search macros » » Permissions

Change the Permission of macro to All apps.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @dyeo,

I think macros are not getting replicating to the indexer. Can you please execute below troubleshooting step?

1) Can you please create a below file in Search Head?

$SPLUNK_HOME$/etc/app/TA-Fidelis-Analytics/default/distsearch.conf

[replicationSettings:refineConf]
replicate.macros = true

2) Restart Splunk.

Please refer: https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Distsearchconf

Thanks

View solution in original post

dyeo
Engager

This appears to have resolved it. Thanks kamlesh_vaghela!

0 Karma

wsmworkhard
Explorer

Resolved my issue as well.

Thank you!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@dyeo
Glad to help you.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!