Saved search error appears after installing the content pack
How to troubleshoot if a saved search error appears after installing the content pack.
Problem
The search specifies a macro 'meraki_index' that cannot be found.
Cause
The Cisco Meraki Add-on for Splunk is not installed. The content pack saved search can’t be activated because it requires a search macro that is defined by the Cisco Meraki Add-on for Splunk.
Solution
Complete the following steps to install the Cisco Meraki add-on for Splunk and activate the saved search.
Install the Cisco Meraki Add-on for Splunk. For installation instructions, see Installation in the Cisco Meraki documentation.
Activate the saved search:
From the ITSI main menu, select Configuration, then Data Integrations.
Select the Content library tab.
Under Splunk Supported Content Packs, select Cisco Enterprise Networks.
Select Proceed.
Under Modify status of saved searches, select Activate all saved searches.
Select Install selected.