KB 115 (Splunk) - Permission Error With 'sap-index' Macro

Description

You may encounter an error with being able to read the ‘sap-index’ macro. The error will look similar to what you see below:

Open

Cause

This issue can be caused by one of the following issues as indicated in the error message:

• The macro name is misspelled.

• You do not have “read” permissions set for the macro, or the macro has not been shared in the application.

Resolution

Misspelling

Check the macro spelling. Correct the spelling of the ‘sap-index’ macro in your search.

Read Permissions

Click on Settings –> Advanced search → Search Macros.

Open

Type in “sap-index” in the search bar as seen below, and select Permissions.

Ensure the permissions are set to “Read” for Everyone. Save.