I've created several macros with a tstat query. when running the macro through the UI, no results are displayed. When I run the tstat through the UI, i get results. I do not have a pipe in front of the query in the macro. Permissions are set to Global for the macro. My Splunk infrastructure is distributed with clustered search peers. Is it possible that the macros are not being expanded and the bundles are not being replicated to the peers?
↧