/
KB 115 - Permission Error With 'sap-index' Macro

KB 115 - Permission Error With 'sap-index' Macro

KB 115 (Splunk) - Permission Error With 'sap-index' Macro

Category: Problem

Priority: Normal

Category: Problem

Priority: Normal

Platform: Splunk

Version: 1 from 23.03.2021

Description

You may encounter an error with being able to read the ‘sap-index’ macro. The error will look similar to what you see below:

Cause

This issue can be caused by one of the following issues as indicated in the error message:

  • The macro name is misspelled.

  • You do not have “read” permissions set for the macro, or the macro has not been shared in the application.

Resolution

Misspelling

Check the macro spelling. Correct the spelling of the ‘sap-index’ macro in your search.

Read Permissions

Click on Settings –> Advanced search → Search Macros.

Type in “sap-index” in the search bar as seen below, and select Permissions.

Ensure the permissions are set to “Read” for Everyone. Save.

 

Related content

KB 165 - Out-of-the-box dashboards not populating data
KB 165 - Out-of-the-box dashboards not populating data
More like this
KB 141 - Error in Setup Page during Upgrade: Cannot find saved search with name ‘* Alert’
KB 141 - Error in Setup Page during Upgrade: Cannot find saved search with name ‘* Alert’
More like this
KB 72 – Adding an Index to Default Search Macro
KB 72 – Adding an Index to Default Search Macro
More like this
KB 195 - System dropdowns for database, cloud, or java dashboards not populating in Splunk App v8.0.1
KB 195 - System dropdowns for database, cloud, or java dashboards not populating in Splunk App v8.0.1
More like this
Create a Splunk Role
Create a Splunk Role
More like this
KB 174 - Orphaned Correlation Searches in ES Content Pack Not Generating Notable Events
KB 174 - Orphaned Correlation Searches in ES Content Pack Not Generating Notable Events
More like this