Splunk Security Essential Macro

[mdubreucq]

Hi everyone

I'm using Splunk Security Essentials and I have a problem with a macro : "get_identity4events(user)"

the error in the search is :

"Error in 'SearchParser': The search specifies a macro 'get_identity4events' that can not be found. Reasons include: the macro name is misspelled, you do not have" read "permission for the macro, or the macro has not been shared with this application, Click Settings, Advanced search, Search Macros to view macro information. "

the macro is missed in the list of macro.

i test to create it but i don't find the content of this macro on the community or docs splunk.

coult you help me please?

thanks 

Maxime

[richgalloway]

That macro is defined in the SA-IdentityManagement app, which is part of Enterprise Security.  You must have ES installed to have the macro.