KB 72 (Splunk): Adding an Index to Default Search Macro

Description

The built in search macros for PowerConnect sap-aba and sap-java only specify the sourcetype they do not specify the index, by default the index is recommended to be added to the default search list in the role that contains the users who will access the index.

The default macros can be accessed through Settings → Advanced Search

Open

Click on “Search macros”

Open

This will show you all Macros, enter ‘sap’ in to the search bar and click on the magnifying glass

Click on the Macro sap-abap or sap-java and edit the Macro to add the text ‘index=<your index> and replace <your index> with the name of your index i.e. index=sap, if you don’t know the name of your index check with your Splunk administrator. Then click Save.

This macro is used by default in all standard PowerConnect dashboards, so they will all search this index by default. We strongly recommend you use this macro to search PowerConnect data.

Product version