Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk ITSI
- :
- Splunk ITSI - The search specifies a macro 'assess...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi, I'm finding lot of these errors in my ITSI cluster (4.4.1/7.3.3) index=_internal
05-12-2020 12:56:01.520 +0200 ERROR SearchParser - The search specifies a macro 'assess_severity' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.
I find 4 macros in the app SA-ITOA, all having 1 to 6 different arguments required. Sharing is Global, everyone have read permissions.
Anyone with an answere or suggestion on what to do?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It was acctually some old searches defined on our deployer. They had the wrong number of inputs. Removed those and pushed new boundle. case closed 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It was acctually some old searches defined on our deployer. They had the wrong number of inputs. Removed those and pushed new boundle. case closed 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The event are followed by an event like:
05-12-2020 12:56:01.520 +0200 ERROR SHCRepJob - failed job=SHPDelegateSearchJob peer="myhostname.fake.splunk.no", guid="E3E36E38-52DC-4F32-83CD-498681B3A8B3" saved_search=system;; err=uri=https://172.20.242.50:8089/servicesNS/nobody/itsi/shcluster/member/delegatejob/Indicator%20-%204eb62..., error=500 - \n In handler 'shclustermemberdelegatejob': Error in 'SearchParser': The search specifies a macro 'assess_severity' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Resolved. It was acctually some old searches defined on our deployer. Removed those and pushed new boundle. case closed 🙂
Fall Into Learning with New Splunk Education Courses
Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...
How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes
