Splunk Enterprise Security

ESS - Simple saved dashboard question

amtm
Engager

Within the ESS application, I created a simple saved dashboard based upon a search:
Splunk -> ESS -> Search
Specify search query -> Actions -> Add to dashboard

After going through the menu, and creating a new dashboard, naming the panel, etc, I had a tough time finding the newly created dashboard. It does not show up in a 'View' menu like the search app; However I was able to see the dashboard in the 'Manage Views' config menu (navigating through the search app). The app context was listed as SplunkESS, so I found I was able to get to the newly created dashboard by navigating to it via url/name directly:

https://mysplunkess:8000/en-US/app/SplunkEnterpriseSecuritySuite/_new_test_dashboard

The dashboard shows correctly, and I am able to edit it. However what I would like to do is have a link to this dashboard within ESS; so it shows up as a clickable menu item in the black navigation bar. When I go to the Domain / Dashboard config menu (Splunk > ESS > Configure > Domains / Dashboards) I do not see my '_new_test_dashboard' dashboard listed. Is there a conf file that needs to be edited directly?

0 Karma
1 Solution

MHibbin
Influencer

amtm,

I do not have access to an ESS installation. However normally to add a view/dropdown to the navigation, you would navigate to the App's navigational view area (i.e. ESS App >> Manager >> User Interface >> Navigation menus), and modify the "default.xml".

It's a pretty simple XML to add you view simply to the navigation bar add something like:

<view name="yourview" />

Probably best to add this at the very beginning or the very end.. so that it doesn't intefer with the core functionality.

Best practice would say to back the XML to a text file, "just in case".

Regards,

MHibbin

View solution in original post

jbillings
Path Finder

Very late to the party for this one, but from the Home page in the Enterprise Security App, select App configuration. This will take you to the ES Configuration. Under General, select Navigation. This will let you edit/add views to the menu.
Regards,
jbillings

0 Karma

MHibbin
Influencer

amtm,

I do not have access to an ESS installation. However normally to add a view/dropdown to the navigation, you would navigate to the App's navigational view area (i.e. ESS App >> Manager >> User Interface >> Navigation menus), and modify the "default.xml".

It's a pretty simple XML to add you view simply to the navigation bar add something like:

<view name="yourview" />

Probably best to add this at the very beginning or the very end.. so that it doesn't intefer with the core functionality.

Best practice would say to back the XML to a text file, "just in case".

Regards,

MHibbin

MHibbin
Influencer

cool, nice one!

0 Karma

amtm
Engager

That did the trick! Thank you very much. I added this code at the end:

<collection label="Custom Dashboards">
<view name="_new_test_dashboard"/>
</collection>
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...