I've got a macro that contains 'sourcetype' and 'index' in search(both of which could be changed from client side).
The macro is being used in different eventtypes for dashboard queries.
On installing the app and TA on a distributed/cluster environment (Splunk v7.2.*), the search using eventtype gives the following error:
Streamed search execute failed because Error in 'SearchParser': The search specifies a macro '[NAME OF THE MACRO]' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.
All the permission for macro, app and TA are defined as per Splunk standards.
I tried using distsearch.conf file but with no help.
... View more