Reporting

How can I hide a saved search?

Simeon
Splunk Employee
Splunk Employee

I have a lot of saved searches that populate my summary index and I do not want them to be viewable in the saved search pull down (drop-down) menu. Is there a way for me to hide or remove these searches from the pull down navigation?

I realize I can hide them by putting them in another app, not sharing the search, or classifying a few of them under a specific label, but I'd prefer to just have them hidden.

Tags (1)
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

You can set is_visible=false in savedsearches.conf for the particular saved searches you don't want to show

$SPLUNK_HOME/etc/system/README/savedsearches.conf.spec
...
is_visible = <bool>
* whether this saved search should be listed in the visible saved search list
* Defaults to true

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

You can set is_visible=false in savedsearches.conf for the particular saved searches you don't want to show

$SPLUNK_HOME/etc/system/README/savedsearches.conf.spec
...
is_visible = <bool>
* whether this saved search should be listed in the visible saved search list
* Defaults to true

sideview
SplunkTrust
SplunkTrust

Nice. I didnt know about this. It does work to hide the saved search from the users' app menus. And it does leave the saved search still visible in Manager which is even better. (in this case Simeon wanted the admins to still be able to edit/clone things in the UI)

0 Karma

Lowell
Super Champion

I've resorted do doing the permission thing with my summary index searches. I've also tried the submenu thing (you know, name the menu "Summary Index -- DO NOT RUN --", which looks great and leads to no unwanted questions. right.) In combination it's not too bad. The menu disappears if the user doesn't have access.

I agree that it really seems like there should really be an easer/better way to do this. I like how views have the isVisible option. I wish something like this were possible with searches.

Does anyone know if this has been officially submited as a feature request?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...