Updating App Macros

[JohnEGones]

Hi Community People.

Our team has stood up a new instance of Splunk, and we have deployed out some cool new apps. One issue I have run into however is that there seems to be a weirdness in how the app is expecting the data.

Specifically, the predefined queries (some using macros) seem to not work, unless there is an index specified. Is there an explanation behind this?

sourcetype=[some preconfigured type from the app] | stats count by someField <===doesn't seem to work

index=someIndex sourcetype=appDefinedSourceType | stats count by someField <===this works

[dtburrows3]

There is a setting for roles in Splunk that configures what indexes are searched by default if an index is not specified in the search itself. This would be my guess is what is going on here if I understood your question correctly.

The user's role that is utilizing the macro probably doesn't have the index set as a default searched index where the data resides.

Here is a screenshot of the UI settings for roles default searched indexes.