Dashboards & Visualizations

Why does my saved search not appear in the navigation bar on a dashboard?

tkreiner
Explorer

I am building out the navigation bar for an app. It appears as follows:

<nav color="#778899">
<view name="my_dashboard" default='true' />
<view name="search" />
<view name="dashboards" />
<saved name="My Saved Search" />
</nav>

When I go to the app, I only see menu items for my_dashboard, search, and dashboards. The saved search doesn't appear. HOWEVER, if I go to search or dashboards, my saved search menu item suddenly appears in the navigation bar and works correctly.

How can I get the saved search menu item to appear in all areas of the application, including when I am on the dashboard?

FRoth
Contributor

I have found a workaround.
Problem still exists in all Splunk versions since version 6.3.4 (see my comments to the initial questions).

If I add the following section to my "default.xml" ...

  <collection label="All Analysis Views">
    <saved source="unclassified" />
  </collection>

... both the new section with all unclassified saved searches and the other menu with my selected searches appear.
Removing the section again and both sections disappear.
I reproduced this behaviour with my THOR App version 1.2.1, which I will update soon to fix this nasty bug with the workaround.

Again - that's the behaviour:

Not showing

   <collection label="Analysis"> <!-- <<< does not show up in Overview Dashboard -->
     <saved name="Base Analysis" default="true" /> <!-- <<< does not show up in Overview Dashboard -->
     <saved name="Rare Warnings and Alerts" />  <!-- <<< does not show up in Overview Dashboard -->
   </collection>

Showing both menu elements

  <collection label="All Analysis Views">
    <saved source="unclassified" />
  </collection> 
  <collection label="Analysis"> <!-- <<< shows up in Overview Dashboard -->
     <saved name="Base Analysis" default="true" /> <!-- <<< shows up in Overview Dashboard -->
     <saved name="Rare Warnings and Alerts" />  <!-- <<< shows up in Overview Dashboard -->
   </collection>

I wonder why no one else has reported this issue since the version 6.3.4 release?

FRoth
Contributor

I do have the exact same problem here. Everyting worked fine in version 6.2 but I upgraded to version 6.4 recently. All the saved searches (reports) navigation bar elements show up in search views but not in the dashboard views.

I noticed that the value "request.ui_dispatch_view" is set to "search" by default. Removing it doesn't solve the issue.
I'll downgrade to version 6.2 to see if the problem is related to version 6.4.

default.xml

<nav search_view="search" color="#333333">
  <!-- <view name="search"/> -->
  <collection label="Dashboards">
    <view name="overview" default="true" />
  </collection>
  <collection label="Analysis"> <!-- <<< does not show up in Overview Dashboard -->
    <saved name="Base Analysis" default="true" /> <!-- <<< does not show up in Overview Dashboard -->
    <saved name="Rare Warnings and Alerts" />  <!-- <<< does not show up in Overview Dashboard -->
  </collection>
  <view name="data_models" />  
  <collection label="Testing">  
    <view name="simple_search"/>  <!-- <<< Clicking this view shows the Analysis Drop Down -->
  </collection> 
</nav>

savedsearches.conf

[Base Analysis]
action.email.reportServerEnabled = 0
action.email.useNSSubject = 1
alert.track = 0
description = Basic search to build useful search statements upon
dispatch.earliest_time = 0
display.events.fields = ["system","level","mainreason","duration","source","sourcetype","host","session_id","eventtype","score","module","matching_strings","message"]
display.general.type = statistics
display.page.search.tab = statistics
display.visualizations.chartHeight = 233
display.visualizations.show = 0
request.ui_dispatch_app = thor
request.ui_dispatch_view = search
search = eventtype=events NOT tag=false_positive ( level=Alert OR level=Warning ) | table system,module,score,mainreason,file,_raw
0 Karma

FRoth
Contributor

This is a bug. How do I report bugs?

0 Karma

FRoth
Contributor

Verified - this error exists since version 6.3.4.
My app works fine in
6.2.4
6.2.9
6.3.0
6.3.1
6.3.2
6.3.3
(yes, I've downloaded and installed them all)

I also cross-checked for statements that are marked as obsolete here

and the known issues in 6.3.4 here

0 Karma

jkat54
SplunkTrust
SplunkTrust

I think this will fix it:

 <nav color="#778899">
  <view name="my_dashboard" default='true' >
  <saved name="My Saved Search" />
  </view>
  <view name="search">
  <saved name="My Saved Search" />
  </view>
  <view name="dashboards" >
  <saved name="My Saved Search" />
  </view>
  </nav>

Or some combo thereof. I hope you can see/understand the difference in my XML vs yours and then solve accordingly. Well that and I hope it solves the problem and I don't look silly trying to help!!!

NOUMSSI
Builder

Hi,
verify that that saved searche has not a private. assure you that the saved searche has a good right

0 Karma

tkreiner
Explorer

I checked and the search is shared to the App. Everyone group has read privileges and admin group has write privilege. So that doesn't appear to be the issue.

Also, I would think that if it were permissions issues, I wouldn't be able to see it all. But I can definitely see it when I'm in the context of the Search app.

Any other ideas?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...