KB 72 (Splunk): Adding an Index to Default Search Macro
Category: Recommendation
Platform: Splunk
Priority: Normal
Version: 1 from 23.03.2021
Description
The built in search macros for PowerConnect sap-aba and sap-java only specify the sourcetype they do not specify the index, by default the index is recommended to be added to the default search list in the role that contains the users who will access the index.
The default macros can be accessed through Settings → Advanced Search
Click on “Search macros”
This will show you all Macros, enter ‘sap’ in to the search bar and click on the magnifying glass
Click on the Macro sap-abap or sap-java and edit the Macro to add the text ‘index=<your index> and replace <your index> with the name of your index i.e. index=sap, if you don’t know the name of your index check with your Splunk administrator. Then click Save.
This macro is used by default in all standard PowerConnect dashboards, so they will all search this index by default. We strongly recommend you use this macro to search PowerConnect data.
Product version
Product | From | To |
PowerConnect [NW,S4HANA,S4HANA Cloud] | [Affected version from] | [Affected version to] |