I have a lot of saved searches that populate my summary index and I do not want them to be viewable in the saved search pull down (drop-down) menu. Is there a way for me to hide or remove these searches from the pull down navigation?
I realize I can hide them by putting them in another app, not sharing the search, or classifying a few of them under a specific label, but I'd prefer to just have them hidden.
You can set is_visible=false in savedsearches.conf for the particular saved searches you don't want to show
$SPLUNK_HOME/etc/system/README/savedsearches.conf.spec ... is_visible = <bool> whether this saved search should be listed in the visible saved search list Defaults to true
I've resorted do doing the permission thing with my summary index searches. I've also tried the submenu thing (you know, name the menu "Summary Index -- DO NOT RUN --", which looks great and leads to no unwanted questions. right.) In combination it's not too bad. The menu disappears if the user doesn't have access.
I agree that it really seems like there should really be an easer/better way to do this. I like how views have the
isVisible option. I wish something like this were possible with searches.
Does anyone know if this has been officially submited as a feature request?
max search length 1 Answer
Evaluation of data as it is read 2 Answers
Saved Searches and Passing Parameters 3 Answers