Security

After creating macros in Splunk Web on a search head, where do I find the path for macros.conf?

pavanae
Builder

I have an app X configured in a search head and there are some x,y,z macros created in Splunk Web. Now I want to open the macros.conf on the backend.

What is the possible path to find the macros.conf?

Is there any grep command to search for macros.conf in $Splunk_Home directory?

Can I find it in search head or indexer?

1 Solution

somesoni2
Revered Legend

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

View solution in original post

somesoni2
Revered Legend

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...