KB 202 (Splunk 8.0+): System dropdown not populating in database or cloud dashboards
|
Category: Problem |
Priority: High |
|---|---|
|
Platform: Splunk |
Version: 1 from 10.04.2024 |
Description
On Splunk App version 8.0+, the system input in SAP Cloud or Database dashboards may not populate.
Cause
A Splunk bug does not allow XOR in certain use cases, leading to search macro “sap-systems(2)” that does not properly resolve.
Resolution
-
Go to “Settings > Advanced Search > Search Macros”
-
Find the “sap-systems(2)” macro.
-
Change it to reflect the modified condition shown below.
Beforeinputlookup pc_sap_systems | search sys_type="*$sys_type$*" AND (sys_subtype="*$sys_subtype$*" XOR db_type="*$sys_subtype$*")After - The XOR has changed to an OR
inputlookup pc_sap_systems | search sys_type="*$sys_type$*" AND (sys_subtype="*$sys_subtype$*" OR db_type="*$sys_subtype$*")