Security

After creating macros in Splunk Web on a search head, where do I find the path for macros.conf?

pavanae
Builder

I have an app X configured in a search head and there are some x,y,z macros created in Splunk Web. Now I want to open the macros.conf on the backend.

What is the possible path to find the macros.conf?

Is there any grep command to search for macros.conf in $Splunk_Home directory?

Can I find it in search head or indexer?

1 Solution

somesoni2
Revered Legend

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

View solution in original post

somesoni2
Revered Legend

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...