This should be the proper answer. We had the same issue and it fixed it. According to btool, before fixing it, the "replicate.macros" setting didn't even exist on our search heads. But after setting it to true, suppressions started working in IR. Another quality software update from splunk 🙄 ... View more