Splunk Search

How to execute macro search with REST API

pravinvram
Engager

How do i execute macros in rest API , example :

curl -ku user:pass https://<url> -d search="`macro name` | table data1 data2"

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Escape the backticks.

curl -ku user:pass https://<url> -d search="\`macro name\` | table data1 data2"
---
If this reply helps you, Karma would be appreciated.
0 Karma

pravinvram
Engager

@richgalloway  - thanks for the details , tired that as well however receiving below error.

I own the macro and there is full permission read , still getting this error

<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="FATAL">User  could not act as: admin</msg>
</messages>
</response>

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It looks like the macro is trying to execute, but the content requires permissions you don't have.  What are the search and macro trying to do?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...

Data Management Digest – June 2026

Welcome to the June 2026 edition of Data Management Digest! This month’s update is short and sweet, with a ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...