KB 202 (Splunk 8.0+): System dropdown not populating in database or cloud dashboards

Description

On Splunk App version 8.0+, the system input in SAP Cloud or Database dashboards may not populate.

Cause

A Splunk bug does not allow XOR in certain use cases, leading to search macro “sap-systems(2)” that does not properly resolve.

Resolution

1. Go to “Settings > Advanced Search > Search Macros”

2. Find the “sap-systems(2)” macro.

3. Change it to reflect the modified condition shown below.
   Before

   inputlookup pc_sap_systems | search sys_type="*$sys_type$*" AND (sys_subtype="*$sys_subtype$*" XOR db_type="*$sys_subtype$*")

   After - The XOR has changed to an OR

   inputlookup pc_sap_systems | search sys_type="*$sys_type$*" AND (sys_subtype="*$sys_subtype$*" OR db_type="*$sys_subtype$*")