Export Views To Only One Specific App

[David]

I wan't to find the right way to share views between different apps, with granularity as to the app.

In my Splunk instance, I have a number of different Apps:

• ITSystem1
• ITSystem2
• ITDashboards
• InternalApp1

I would like MyCompany's nav to be able to include the contents of ITSystem1 and ITSystem2 (e.g., having a main app with different subapps). I've got this working by export = systeming the views in ITSystem1 and ITSystem2. This was slightly ugly when I tried to look at things in manager, but still reasonable.

Now I'm adding InternalApp1, which is a sales tool, and I would like to have things like the default Saved Searches nav list working. But because I have to export so many things for my ITSystem apps to system, the nav is filled with tons of content that shouldn't be listed in InternalApp1.

What's the best way to do this?

[effem]

Still not done yet?

[Starlette]

I got this question a lot as well, would be nice to see it filled!

[David · Accepted solution]

This doesn't appear to be possible at this juncture, but has been filed as an enhancement request. Rationale provided for the change:

As it currently stands, this is messy and a disincentive to publishing Apps to Splunkbase. It's a hassle to maintain two copies for an app -- one for Splunkbase and one for internal consumption, so exporting views is valuable. But filling the nav on user-facing apps with lots of totally unrelated objects makes it difficult to use, and makes users less likely to actually use Splunk for anything but pre-canned reports.

[hazekamp]

David,

As of 4.2.0, you only have the option of exporting content within the app it's contained, or system wide. Per default.meta.spec:

# Set access controls on a specific view in this app.
[views/index_status]
access = read : [ admin ], write : [ admin ]
* Allow only admin users to read or modify this view.

# Make this view available in all apps.
export = system
* To make this view available only in this app, set 'export = none' instead.
owner = admin
* Set admin as the owner of this view.

See also: http://www.splunk.com/base/Documentation/4.2/admin/Defaultmetaconf

[David]

Okay. I've filed this as an enhancement request.

[hazekamp]

That's correct. If you export something as 'none', it is only available from within the contained app. Exporting as 'system' will make it available to all visible apps.

[David]

So that means I can't export something to only one particular app, correct? Or alternatively, I can't prevent another app from inheriting views?