Dashboards & Visualizations

navigation menu consolidation

aaronkorn
Splunk Employee
Splunk Employee

Hello,

What is the best way to edit the navigation menu dropdowns to contain sub-elements. For example we would want to group certain searches and dashboards under particular categories like this under Errors: alt text

0 Karma
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

You would want to edit a navigation.

http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/BuildNavigation

Just to give you an idea, the way they were able to get the views with "error" to appear is by adding a collection with a "match=error". This then matches views that have error in the name.

<collection label="Saved Searches">
<saved name="Daily indexing volume by server" view="charting" />
  <collection label="Errors">
    <saved source="unclassified" match="error" />
  </collection>
<saved source="unclassified" />
</collection>

View solution in original post

okrabbe_splunk
Splunk Employee
Splunk Employee

You would want to edit a navigation.

http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/BuildNavigation

Just to give you an idea, the way they were able to get the views with "error" to appear is by adding a collection with a "match=error". This then matches views that have error in the name.

<collection label="Saved Searches">
<saved name="Daily indexing volume by server" view="charting" />
  <collection label="Errors">
    <saved source="unclassified" match="error" />
  </collection>
<saved source="unclassified" />
</collection>

okrabbe_splunk
Splunk Employee
Splunk Employee

Unfortunately there is no easy way to do this outside of having a naming convention for your views.

See this answer:
http://splunk-base.splunk.com/answers/12744/navigation-menu-xml-match-help

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

This worked. Thanks! How would you specify multiple match strings?

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Ah, so I just realized that the matching appears to happen in order. So for example, unless you move the "view source=unclassified" down below the Cerner match you will still see them once at the top and once in the matched group.

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Yep. Any other ideas?

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

The code looks good...I am surprised that is not working. You have done a restart and clear out your browser cache?

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Yes I have a view called Cerner RTMS and it is being grouped under the matched collection but is still an option under the main drop-down







Manage Views

Create dashboard...

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

My past experience has been when it matches it should show up only under the matched collection. Are you seeing something different?

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Excellent! Thank you!!! One question though.. How do I remove the original view from the list once it has been added to a grouping?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...