Reporting

How can I hide a collection of saved searches?

ftk
Motivator

I have a number of searches updating summary indexes that I do not want to show up in my app' s navigation UI under Searches & Reports.

I can use the isVisible="false" tag to hide views in the navigation menu, but the same tag doesn't appear to work for collections. I am aware that I can use is_visible=false in savedsearches.conf, but I would prefer not to have to do that manually for every search I want to hide.

What options do I have to hide groups of saved searches in the UI?

Tags (3)
1 Solution

sideview
SplunkTrust
SplunkTrust

The default.xml file aka the app navigation cannot hide whole collections of searches and views. As you've discovered, you can put isVisible="false" in the individual view xml files, and/or in the individual saved searches.

However you can also make views and saved searches visible or invisible to different users depending on the users' roles.

There may be a better docs link than this one, but here's a link to the relevant section in the developer manual. http://www.splunk.com/base/Documentation/4.1.3/Developer/Step5SetPermissions

And I dont recommend it, but if setting read-access by role wasnt an option for some reason you could at a pinch define a collection in the nav and then use custom CSS to make that particular menu item invisible and inaccessible in the UI. Sort of a roach motel collection.

some "custom CSS" elaboration:

here are the general docs about custom css http://www.splunk.com/base/Documentation/latest/Developer/UseCSS

and if your menu item you wanted to banish was the 3rd item in the menu i believe the particular CSS would be:

#navmenu_2 {
    display:none;
}

View solution in original post

sideview
SplunkTrust
SplunkTrust

The default.xml file aka the app navigation cannot hide whole collections of searches and views. As you've discovered, you can put isVisible="false" in the individual view xml files, and/or in the individual saved searches.

However you can also make views and saved searches visible or invisible to different users depending on the users' roles.

There may be a better docs link than this one, but here's a link to the relevant section in the developer manual. http://www.splunk.com/base/Documentation/4.1.3/Developer/Step5SetPermissions

And I dont recommend it, but if setting read-access by role wasnt an option for some reason you could at a pinch define a collection in the nav and then use custom CSS to make that particular menu item invisible and inaccessible in the UI. Sort of a roach motel collection.

some "custom CSS" elaboration:

here are the general docs about custom css http://www.splunk.com/base/Documentation/latest/Developer/UseCSS

and if your menu item you wanted to banish was the 3rd item in the menu i believe the particular CSS would be:

#navmenu_2 {
    display:none;
}

ftk
Motivator

Can you please elaborate on the custom CSS you refer to in your last paragraph?

Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...