...
Optional Configuration (Macro):
Certain users/roles may not search the designated PowerConnect Splunk index by default. In order for saved searches to function properly, the “sap-index” macro may need to be set to specify the index for the SAP data sent to Splunk from PowerConnect.
On Splunk's menu bar, Click on Settings -> “Advanced search” -> “Search Macros”.
Click on the “sap-index” macro and mention the index name in the Definition where data is incoming. Please see the sample below:
(index="main" OR index="sample1" OR index="sample2")
Note: For selecting all value of an entity, "*" (asterisk) can be used. Logical operators like "AND", "OR" should be capitalized when used in Definition.Click on the Save Button.
...