Security

After creating macros in Splunk Web on a search head, where do I find the path for macros.conf?

pavanae
Builder

I have an app X configured in a search head and there are some x,y,z macros created in Splunk Web. Now I want to open the macros.conf on the backend.

What is the possible path to find the macros.conf?

Is there any grep command to search for macros.conf in $Splunk_Home directory?

Can I find it in search head or indexer?

1 Solution

somesoni2
Revered Legend

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

View solution in original post

somesoni2
Revered Legend

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...