Splunk Search

Splunk App for AWS: How do I resolve error "The search specifies a macro 'aws-description-instance' that cannot be foun

jaibalaraman
Path Finder

How do I resolve the  following error?

 

sample 1.PNG

 

Error in 'SearchParser': The search specifies a macro 'aws-cloudtrail-sourcetype' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

Labels (1)

jaibalaraman
Path Finder

screen.JPG

0 Karma

jaibalaraman
Path Finder

Hi 

I assume why i am getting error is because the below macro are not seen in the search macros

`aws-cloudtrail-sourcetype` eventName=StopInstances OR eventName=RebootInstances OR eventName=TerminateInstances NOT errorCode | rename "requestParameters.instancesSet.items{}.instanceId" AS instanceId | stats values(instanceId) as instanceId count(instanceId) as count by awsRegion eventName eventTime userIdentity.arn eventID

However i tried clone the existing macro and tried to create a new one , still i am getting an error message when saving. 

Err msg " Encountered the following error while trying to save: Number of arguments provided (1) does not match with the number implied by the macro name (0)"

0 Karma

jaibalaraman
Path Finder

Hi 

Yes i am able to see the macro , also have permission to Edit , Enable or disable.

 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

ohk, on the settings, advanced search, search macros, are you able to search/view that macro -  'aws-cloudtrail-sourcetype' ...probably, as you have some permissions issues, you may not be able to "Read" it, i think. if you are running this from "search" app, try to run it from some other app(just in case, if this macro is not shared with "search" app).
if still you face the same error, then, you will need to check with splunk admins/power users/aws splunk admins for read permission. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

jaibalaraman
Path Finder

Hi 

I assume why i am getting error is because the below macro are not seen in the search macros

`aws-cloudtrail-sourcetype` eventName=StopInstances OR eventName=RebootInstances OR eventName=TerminateInstances NOT errorCode | rename "requestParameters.instancesSet.items{}.instanceId" AS instanceId | stats values(instanceId) as instanceId count(instanceId) as count by awsRegion eventName eventTime userIdentity.arn eventID

However i tried clone the existing macro and tried to create a new one , still i am getting an error message when saving. 

Err msg " Encountered the following error while trying to save: Number of arguments provided (1) does not match with the number implied by the macro name (0)"

0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...