I recently deployed ES and went through a "proper' installation. I'm running into an issue with most dashboards and looking at logs this is what I see:
"Error in 'SearchParser': The search specifies a macro 'cim_Network_Traffic_indexes' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information."
When I go into the macro settings and click on the macro it takes me to the CIM Setup page AND the macro is enabled, spelled correctly, and exists!
I've tried (and sometimes this works) to create my own macro with same name and global settings. But does not work 100% of the time.
Has anyone run into this? Thanks!
Hello @code_assassin Have you validated the permission of the Splunk_SA_CIM, or perhaps re-install the same if it's fresh installation only?
If you have installed ES over SHC, it can also happen because of KO replication issues, so make sure there are no issues in SHC.