All Apps and Add-ons

Microsoft 365 App for Splunk: macro error on overview dashboard

adalbor
Builder

Hey All,

Finishing the configuration and tuning of the Microsoft 365 App for Splunk and on the overview dashboard under M365 a single panel is having an issue with a macro.

Error message:

Error in 'SearchParser': The search specifies a macro 'o365_service_status' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

I checked the app's default and local folders and in the GUI and don't even see this macro anywhere.

Anyone have any clue what this macro holds so that I can create it to get this dashboard panel working?

Thanks,

Andrew

Labels (3)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...