Hello @halime Can you please verify the share level of the macro? - if it's private, app-level or Global? Because at times, you may have read permission but the search query needs to be run from a specific app (if it's app level permission), and not from any other app.   Also, AFAIK "drop_dm_object_name" is the default macro from "Splunk_SA_CIM", so you may want to install the app (https://splunkbase.splunk.com/app/1621) instead of creating a macro on your own.     Please accept the answer if it helps! ... View more