Skip to main content
Skip table of contents

KB 72 – Adding an Index to Default Search Macro

KB 72 (Splunk): Adding an Index to Default Search Macro

Category: Recommendation

Platform: Splunk

Priority: Normal

Version: 1 from 23.03.2021


The built in search macros for PowerConnect sap-aba and sap-java only specify the sourcetype they do not specify the index, by default the index is recommended to be added to the default search list in the role that contains the users who will access the index.

The default macros can be accessed through Settings → Advanced Search

Click on “Search macros”

This will show you all Macros, enter ‘sap’ in to the search bar and click on the magnifying glass

Click on the Macro sap-abap or sap-java and edit the Macro to add the text ‘index=<your index> and replace <your index> with the name of your index i.e. index=sap, if you don’t know the name of your index check with your Splunk administrator. Then click Save.

This macro is used by default in all standard PowerConnect dashboards, so they will all search this index by default. We strongly recommend you use this macro to search PowerConnect data.

Product version




PowerConnect [NW,S4HANA,S4HANA Cloud]

[Affected version from]

[Affected version to]

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.