Splunk Enterprise Security

Why does the search specifies a macro 'fidelis_get_xps_event' cannot be found?

Engager

In our environment we have 3 separate non-distributed search heads and a 3-clustered indexers. When I try running the following search:

(`cim_Malware_indexes`) tag=malware tag=attack

I receive the following search error message:

3 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.

[indexer01] Streamed search execute failed because: Error in 'SearchParser': The search specifies a macro 'fidelis_get_xps_event' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

[indexer02] Streamed search execute failed because: Error in 'SearchParser': The search specifies a macro 'fidelis_get_xps_event' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

[indexer03] Streamed search execute failed because: Error in 'SearchParser': The search specifies a macro 'fidelis_get_xps_event' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I'm not sure why the macro would need to be on the indexers, but does fidelis_get_xps_event macro need to be replicated to the indexers?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @dyeo,

I think macros are not getting replicating to the indexer. Can you please execute below troubleshooting step?

1) Can you please create a below file in Search Head?

$SPLUNK_HOME$/etc/app/TA-Fidelis-Analytics/default/distsearch.conf

[replicationSettings:refineConf]
replicate.macros = true

2) Restart Splunk.

Please refer: https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Distsearchconf

Thanks

View solution in original post

Builder

I experienced a similar problem. When I tried to search two datamodels, I got the error that the macro was missing. It turned out that there was a tags.conf file that applied the tags for the two different datamodels, but there was no corresponding eventtypes.conf file that was applying those tags. When I removed the tags.conf file, the problem went away.

0 Karma

Esteemed Legend

Try using SHIFT-CTRL-E to expand through layers of macros to see where that macro is being pulled in.

0 Karma

Please check the permissions for your macro "fidelis_get_xps_event".

There is a case if the macro is not shared with "All apps" and if you are trying to use the macro somewhere in another application then you will get the Error in SearchParser.

Settings » Advanced search » Search macros » » Permissions

Change the Permission of macro to All apps.

0 Karma

SplunkTrust
SplunkTrust

Hi @dyeo,

I think macros are not getting replicating to the indexer. Can you please execute below troubleshooting step?

1) Can you please create a below file in Search Head?

$SPLUNK_HOME$/etc/app/TA-Fidelis-Analytics/default/distsearch.conf

[replicationSettings:refineConf]
replicate.macros = true

2) Restart Splunk.

Please refer: https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Distsearchconf

Thanks

View solution in original post

Engager

This appears to have resolved it. Thanks kamlesh_vaghela!

0 Karma

Explorer

Resolved my issue as well.

Thank you!

0 Karma

SplunkTrust
SplunkTrust

@dyeo
Glad to help you.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!