ERROR SearchParser

[erlindemberg]

ERROR SearchParser - The search specifies a macro 'bcoat_request' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

Guys, help me, haw can i resolve this problem?

[woodcock]

Many apps ship with blank macro definitions which the Splunk admin is supposed to modify so that the SPL in the app knows what index/sourcetype contains the data that it needs to run. Read the documentation for your app.

[richgalloway]

Have you tried the suggestion offered in the error message? Go to Settings->Advanced search->Search macros and verify the "bcoat_request" macro exists and is shared with the app in which you are trying to use it. If it doesn't exist, re-install the Bluecoat app to restore the macro.