KB 115 (Splunk) - Permission Error With 'sap-index' Macro
Version: 1 from 23.03.2021
You may encounter an error with being able to read the ‘sap-index’ macro. The error will look similar to what you see below:
This issue can be caused by one of the following issues as indicated in the error message:
The macro name is misspelled.
You do not have “read” permissions set for the macro, or the macro has not been shared in the application.
Check the macro spelling. Correct the spelling of the ‘sap-index’ macro in your search.
Click on Settings –> Advanced search → Search Macros.
Type in “sap-index” in the search bar as seen below, and select Permissions.
Ensure the permissions are set to “Read” for Everyone. Save.