Getting following errors from failed |mcatalog search against metrics index using a power user role. The |mcatalog search runs ok with admin role. The search was running ok in Splunk 7.3.3 but getting error in Splunk 8.0.2. Power user role has the metric_alerts and list_metrics_catalog capabilities
Search: |mcatalog values(metric_name) where index=os_metrics causing
ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported
ERROR SearchOrchestrator - Term based search is not supported
ERROR SearchStatusEnforcer - sid:1597278941.14635_FE8E9C88-7BFB-466C-BA64-C8544C690C88 Term based search is not supported
ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Term based search is not supported
Any suggestions on the cause of the "Term based search is not supported" and solution would be welcome. Thanks.