Splunk IT Service Intelligence

Splunk ITSI - The search specifies a macro 'assess_severity' that cannot be found

taskar
Path Finder

hi, I'm finding lot of these errors in my ITSI cluster (4.4.1/7.3.3) index=_internal

05-12-2020 12:56:01.520 +0200 ERROR SearchParser - The search specifies a macro 'assess_severity' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I find 4 macros in the app SA-ITOA, all having 1 to 6 different arguments required. Sharing is Global, everyone have read permissions.

Anyone with an answere or suggestion on what to do?

Labels (2)
0 Karma
1 Solution

taskar
Path Finder

It was acctually some old searches defined on our deployer. They had the wrong number of inputs. Removed those and pushed new boundle. case closed 🙂

View solution in original post

0 Karma

taskar
Path Finder

It was acctually some old searches defined on our deployer. They had the wrong number of inputs. Removed those and pushed new boundle. case closed 🙂

0 Karma

taskar
Path Finder

The event are followed by an event like:
05-12-2020 12:56:01.520 +0200 ERROR SHCRepJob - failed job=SHPDelegateSearchJob peer="myhostname.fake.splunk.no", guid="E3E36E38-52DC-4F32-83CD-498681B3A8B3" saved_search=system;; err=uri=https://172.20.242.50:8089/servicesNS/nobody/itsi/shcluster/member/delegatejob/Indicator%20-%204eb62..., error=500 - \n In handler 'shclustermemberdelegatejob': Error in 'SearchParser': The search specifies a macro 'assess_severity' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

0 Karma

taskar
Path Finder

Resolved. It was acctually some old searches defined on our deployer. Removed those and pushed new boundle. case closed 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...