KB 072 – Adding an index to default search macro
The built in search macros for PowerConnect sap-aba and sap-java only specify the sourcetype they do not specify the index, by default the index is recommended to be added to the default search list in the role that contains the users who will access the index.
The default macros can be accessed through Settings -> Advanced Settings
Search Macros
This will show you all Macros, enter ‘sap’ in to the search bar and click on the magnifying glass
This will show you 2 Marcos sap-abap and sap-java
Click on the Macro sap-abap or sap-java and edit the Macro to add the text ‘index=<your index> and replace <your index> with the name of your index i.e. index=sap, if you don’t know the name of your index check with your Splunk administrator.
Save the Macro.
This macro is used by default in all standard PowerConnect dashboards, so they will all search this index by default.
We strongly recommend you use this Marco to search PowerConnect data.