KB 072 – Adding an index to default search macro

The built in search macros for PowerConnect sap-aba and sap-java only specify the sourcetype they do not specify the index, by default the index is recommended to be added to the default search list in the role that contains the users who will access the index.

The default macros can be accessed through Settings -> Advanced Settings

KB 072 - Adding an index to default search macro 1

Search Macros

KB 072 - Adding an index to default search macro 2

This will show you all Macros, enter ‘sap’ in to the search bar and click on the magnifying glass

KB 072 - Adding an index to default search macro 3

This will show you 2 Marcos sap-abap and sap-java

KB 072 - Adding an index to default search macro 4

Click on the Macro sap-abap or sap-java and edit the Macro to add the text ‘index=<your index> and replace <your index> with the name of your index i.e. index=sap, if you don’t know the name of your index check with your Splunk administrator.

KB 072 - Adding an index to default search macro 5

Save the Macro.

This macro is used by default in all standard PowerConnect dashboards, so they will all search this index by default.

KB 072 - Adding an index to default search macro 6

We strongly recommend you use this Marco to search PowerConnect data.

Download PDF version here