Strange CIM Issues- How would we fix?

[code_assassin]

Hello Splunkers, 

I recently deployed ES and went through a "proper' installation. I'm running into an issue with most dashboards and looking at logs this is what I see:

"Error in 'SearchParser': The search specifies a macro 'cim_Network_Traffic_indexes' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information."

When I go into the macro settings and click on the macro it takes me to the CIM Setup page AND the macro is enabled, spelled correctly, and exists!

I've tried (and sometimes this works) to create my own macro with same name and global settings. But does not work 100% of the time. 

Has anyone run into this? Thanks!

Best,
A

[meetmshah]

Were you able to resolve this @code_assassin?

Please accept the solution if this helps!

[isoutamo]

Have you check that it's sharing is set to Global? Also check that the whole app has shared as Global and permission for both are set Read for Everyone.

[meetmshah]

Hello @code_assassin Have you validated the permission of the Splunk_SA_CIM, or perhaps re-install the same if it's fresh installation only?

If you have installed ES over SHC, it can also happen because of KO replication issues, so make sure there are no issues in SHC.