Security

After creating macros in Splunk Web on a search head, where do I find the path for macros.conf?

pavanae
Builder

I have an app X configured in a search head and there are some x,y,z macros created in Splunk Web. Now I want to open the macros.conf on the backend.

What is the possible path to find the macros.conf?

Is there any grep command to search for macros.conf in $Splunk_Home directory?

Can I find it in search head or indexer?

1 Solution

somesoni2
Revered Legend

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

View solution in original post

somesoni2
Revered Legend

If the macros are created as private for user, you'll find them in $Splunk_Home/etc/users/<<UserWhoCreatedMacro>>/X/local/macros.conf

If the macros created as shared within app OR global , you'll find them in $Splunk_Home/etc/apps/X/local/macros.conf

Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...