Splunk Enterprise

Splunk Security Essential Macro

mdubreucq
Observer

Hi everyone

I'm using Splunk Security Essentials and I have a problem with a macro : "get_identity4events(user)"

the error in the search is :

"Error in 'SearchParser': The search specifies a macro 'get_identity4events' that can not be found. Reasons include: the macro name is misspelled, you do not have" read "permission for the macro, or the macro has not been shared with this application, Click Settings, Advanced search, Search Macros to view macro information. "

the macro is missed in the list of macro.

i test to create it but i don't find the content of this macro on the community or docs splunk.

coult you help me please?

thanks 

Maxime

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That macro is defined in the SA-IdentityManagement app, which is part of Enterprise Security.  You must have ES installed to have the macro.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...