Splunk Enterprise Security

Strange CIM Issues- How would we fix?


Hello Splunkers, 

I recently deployed ES and went through a "proper' installation. I'm running into an issue with most dashboards and looking at logs this is what I see:

"Error in 'SearchParser': The search specifies a macro 'cim_Network_Traffic_indexes' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information."

When I go into the macro settings and click on the macro it takes me to the CIM Setup page AND the macro is enabled, spelled correctly, and exists!

I've tried (and sometimes this works) to create my own macro with same name and global settings. But does not work 100% of the time. 

Has anyone run into this? Thanks!


Labels (1)
0 Karma


Were you able to resolve this @code_assassin?


Please accept the solution if this helps!

0 Karma


Have you check that it's sharing is set to Global? Also check that the whole app has shared as Global and permission for both are set Read for Everyone.

0 Karma


Hello @code_assassin Have you validated the permission of the Splunk_SA_CIM, or perhaps re-install the same if it's fresh installation only?

If you have installed ES over SHC, it can also happen because of KO replication issues, so make sure there are no issues in SHC.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...