What is the root cause of the message preventing saving a search:
![alt text][1]
Error in 'SearchParser': The search specifies a macro..
This error started appearing after a migration from an old SHC to a new SHC.
The resolution was to move the macro to the same app as the search, even though it was set to Global sharing, but that doesn't explain the root cause. The error returns when the macro is moved back to the original app.
[1]: /storage/temp/283680-splunk-search-parser-18-feb-20.png
↧