Refine your search:

3
1

I have a lot of saved searches that populate my summary index and I do not want them to be viewable in the saved search pull down (drop-down) menu. Is there a way for me to hide or remove these searches from the pull down navigation?

I realize I can hide them by putting them in another app, not sharing the search, or classifying a few of them under a specific label, but I'd prefer to just have them hidden.

asked 31 Mar '10, 17:09

Simeon's gravatar image

Simeon ♦
4.4k131436
accept rate: 27%


2 Answers:

You can set is_visible=false in savedsearches.conf for the particular saved searches you don't want to show

$SPLUNK_HOME/etc/system/README/savedsearches.conf.spec
...
is_visible = <bool>
* whether this saved search should be listed in the visible saved search list
* Defaults to true
link

answered 03 Apr '10, 20:29

Ledion%20Bitincka's gravatar image

Ledion Bitincka ♦
2.5k1510
accept rate: 34%

Nice. I didnt know about this. It does work to hide the saved search from the users' app menus. And it does leave the saved search still visible in Manager which is even better. (in this case Simeon wanted the admins to still be able to edit/clone things in the UI)

(05 Apr '10, 17:43) sideview ♦

I've resorted do doing the permission thing with my summary index searches. I've also tried the submenu thing (you know, name the menu "Summary Index -- DO NOT RUN --", which looks great and leads to no unwanted questions. right.) In combination it's not too bad. The menu disappears if the user doesn't have access.

I agree that it really seems like there should really be an easer/better way to do this. I like how views have the isVisible option. I wish something like this were possible with searches.

Does anyone know if this has been officially submited as a feature request?

link

answered 01 Apr '10, 15:22

Lowell's gravatar image

Lowell ♦
12.5k2422113
accept rate: 41%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×332

Asked: 31 Mar '10, 17:09

Seen: 1,456 times

Last updated: 03 Apr '10, 20:29

Copyright © 2005-2014 Splunk Inc. All rights reserved.