Document toolboxDocument toolbox

KB 115 - Permission Error With 'sap-index' Macro

Owned by Stephen Bangs
Jul 12, 2021
2 min read

KB 115 (Splunk) - Permission Error With 'sap-index' Macro

Category: Problem

Priority: Normal

Category: Problem

Priority: Normal

Platform: Splunk

Version: 1 from 23.03.2021

Description

You may encounter an error with being able to read the ‘sap-index’ macro. The error will look similar to what you see below:

Cause

This issue can be caused by one of the following issues as indicated in the error message:

  • The macro name is misspelled.

  • You do not have “read” permissions set for the macro, or the macro has not been shared in the application.

Resolution

Misspelling

Check the macro spelling. Correct the spelling of the ‘sap-index’ macro in your search.

Read Permissions

Click on Settings –> Advanced search → Search Macros.

Type in “sap-index” in the search bar as seen below, and select Permissions.

Ensure the permissions are set to “Read” for Everyone. Save.