KB 115 - Permission Error With 'sap-index' Macro
KB 115 (Splunk) - Permission Error With 'sap-index' Macro
Category: Problem | Priority: Normal |
|---|---|
Platform: Splunk | Version: 1 from 23.03.2021 |
Description
You may encounter an error with being able to read the ‘sap-index’ macro. The error will look similar to what you see below:
Cause
This issue can be caused by one of the following issues as indicated in the error message:
The macro name is misspelled.
You do not have “read” permissions set for the macro, or the macro has not been shared in the application.
Resolution
Misspelling
Check the macro spelling. Correct the spelling of the ‘sap-index’ macro in your search.
Read Permissions
Click on Settings –> Advanced search → Search Macros.
Type in “sap-index” in the search bar as seen below, and select Permissions.
Ensure the permissions are set to “Read” for Everyone. Save.
