Saved search error appears after installing the content pack
How to troubleshoot if a saved search error appears after installing the content pack.
Problem
The search specifies a macro 'meraki_index' that cannot be found.
Cause
The Cisco Meraki Add-on for Splunk is not installed. The content pack saved search can’t be activated because it requires a search macro that is defined by the Cisco Meraki Add-on for Splunk.
Solution
Complete the following steps to install the Cisco Meraki add-on for Splunk and activate the saved search.
-
Install the Cisco Meraki Add-on for Splunk. For installation instructions, see Installation in the Cisco Meraki documentation.
-
Activate the saved search:
-
From the ITSI main menu, select Configuration, then Data Integrations.
-
Select the Content library tab.
-
Under Splunk Supported Content Packs, select Cisco Enterprise Networks.
-
Select Proceed.
-
Under Modify status of saved searches, select Activate all saved searches.
-
Select Install selected.
-