Duplicate macros created if used in detection and defined in macro yaml file

Apologies for the poor title, couldn't think of a good, non-verbose way to put it.

The issue I ran into is that when I run contentctl build, the resulting dist/app_name/default/macros.conf file will contain duplicate entries for the same macro name if:

1. The macro is used in a detection, and
2. I've defined the macro in a yaml file in the "macros" folder

Using the detect_outbound_smb_traffic.yml detection as an example, in the SPL it uses the macro detect_outbound_smb_traffic_filter at the end. If I do nothing else, when I run the build command, there will be a macros.conf file with

[detect_outbound_smb_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

This is good to avoid Splunk complaining about missing macros, however I wanted to create my own definition so that the macro can be updated via source control. If I then create a file macros/detect_outbound_smb_traffic_filter.yml with this definition:

definition: 'search dest_ip!=127.0.0.1'
description: Custom definition for detect_outbound_smb_traffic_filter macro
name: detect_outbound_smb_traffic_filter

The resulting macros.conf file will contain:

[detect_outbound_smb_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.


[detect_outbound_smb_traffic_filter]
definition = search dest_ip!=127.0.0.1
description = Custom definition for detect_outbound_smb_traffic_filter macro

I think Splunk will use the second definition since it comes later in the file, but I'm not sure. At any rate, it would be great if only the "custom" macro was included in macros.conf.

My apologies if this is a known issue, feel free to close as needed. Thanks!

Start with the contentctl build path that generates dist/app_name/default/macros.conf, then trace how detection-referenced macros and YAML files in macros/ are collected. Reproduce the issue with detect_outbound_smb_traffic.yml and macros/detect_outbound_smb_traffic_filter.yml; done means macros.conf contains one entry using the custom definition.