Error: The search specifies a macro 'drop_dm_object_name' that cannot be found. Reasons include: the macro name is miss

[halime]

Hello,

On the Splunk search&reporting page "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes .process=*urlcache* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `certutil_download_with_urlcache_and_split_arguments_filter`"" Error in 'SearchParser': The search specifies a macro 'drop_dm_object_name' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information."
I created the 'drop_dm_object_name' macro and I keep getting this error even though I have given read permission. Although I also created the "security_content_ctime" and "certutil_download_with_urlcache_and_split_arguments_filter" macros, I get the same error for these macros. Can you please help me to solve this problem?

[meetmshah]

Hello @halime Can you please verify the share level of the macro? - if it's private, app-level or Global? Because at times, you may have read permission but the search query needs to be run from a specific app (if it's app level permission), and not from any other app.

Also, AFAIK "drop_dm_object_name" is the default macro from "Splunk_SA_CIM", so you may want to install the app (https://splunkbase.splunk.com/app/1621) instead of creating a macro on your own.

Please accept the answer if it helps!