Splunk Search

Updating App Macros

JohnEGones
Path Finder

Hi Community People.

Our team has stood up a new instance of Splunk, and we have deployed out some cool new apps. One issue I have run into however is that there seems to be a weirdness in how the app is expecting the data.

Specifically, the predefined queries (some using macros) seem to not work, unless there is an index specified. Is there an explanation behind this?

 

 

 

 

 

sourcetype=[some preconfigured type from the app] | stats count by someField <===doesn't seem to work

index=someIndex sourcetype=appDefinedSourceType | stats count by someField <===this works

 

 

 

 

 

Labels (1)
Tags (2)
0 Karma

dtburrows3
Builder

There is a setting for roles in Splunk that configures what indexes are searched by default if an index is not specified in the search itself. This would be my guess is what is going on here if I understood your question correctly.

The user's role that is utilizing the macro probably doesn't have the index set as a default searched index where the data resides.

Here is a screenshot of the UI settings for roles default searched indexes.

dtburrows3_0-1705347463713.png

 

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...