KB 115 (Splunk) - Permission Error With 'sap-index' Macro

Category: Problem

Priority: Normal

Platform: Splunk

Version: 1 from 23.03.2021


You may encounter an error with being able to read the ‘sap-index’ macro. The error will look similar to what you see below:


This issue can be caused by one of the following issues as indicated in the error message:

  • The macro name is misspelled.

  • You do not have “read” permissions set for the macro, or the macro has not been shared in the application.



Check the macro spelling. Correct the spelling of the ‘sap-index’ macro in your search.

Read Permissions

Click on Settings –> Advanced search → Search Macros.

Type in “sap-index” in the search bar as seen below, and select Permissions.

Ensure the permissions are set to “Read” for Everyone. Save.