Splunk Enterprise

mcatalog causing ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported

Path Finder

Hi,

Getting following errors from failed |mcatalog search against metrics index using a power user role. The |mcatalog search runs ok with admin role. The search was running ok in Splunk 7.3.3 but getting error in Splunk 8.0.2. Power user role has the metric_alerts and list_metrics_catalog capabilities

Search: |mcatalog values(metric_name) where index=os_metrics causing

ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported

ERROR SearchOrchestrator - Term based search is not supported
ERROR SearchStatusEnforcer - sid:1597278941.14635_FE8E9C88-7BFB-466C-BA64-C8544C690C88 Term based search is not supported
ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Term based search is not supported

  Any suggestions on the cause of the "Term based search is not supported" and solution would be welcome. Thanks.

Labels (1)
0 Karma