Experiencing a 'Search Peer has the following message: 'Error in 'SearchParser

[stevediaz]

Hello

I've encountered an issue in my Splunk environment that's been causing some headaches. When running a search, I receive the following error message: "Search Peer has the following message: 'Error in 'SearchParser': The search specifies a macro 'my_macro' that cannot be found.'"

This error seems to be related to a missing macro called 'my_macro,' but I'm unsure why this is happening and how to resolve it. I've checked my search query, and it appears to be correct. Can anyone provide some guidance on what might be causing this error and how I can go about resolving it?

Any help or insights would be greatly appreciated!

Thank you.

[VatsalJagani]

@stevediaz - This message tells that either:

• The macro either does not exist.
• OR the macro is not permissible to execute in the search and in the App it is currently being used.

Any Splunk Admin can go and find the macro and its permission from Splunk UI > Advanced search > macros in the settings.

I hope this helps!!! Kindly upvote if it helps!!!