Splunk Enterprise Security

ESS - Simple saved dashboard question

amtm
Engager

Within the ESS application, I created a simple saved dashboard based upon a search:
Splunk -> ESS -> Search
Specify search query -> Actions -> Add to dashboard

After going through the menu, and creating a new dashboard, naming the panel, etc, I had a tough time finding the newly created dashboard. It does not show up in a 'View' menu like the search app; However I was able to see the dashboard in the 'Manage Views' config menu (navigating through the search app). The app context was listed as SplunkESS, so I found I was able to get to the newly created dashboard by navigating to it via url/name directly:

https://mysplunkess:8000/en-US/app/SplunkEnterpriseSecuritySuite/_new_test_dashboard

The dashboard shows correctly, and I am able to edit it. However what I would like to do is have a link to this dashboard within ESS; so it shows up as a clickable menu item in the black navigation bar. When I go to the Domain / Dashboard config menu (Splunk > ESS > Configure > Domains / Dashboards) I do not see my '_new_test_dashboard' dashboard listed. Is there a conf file that needs to be edited directly?

0 Karma
1 Solution

MHibbin
Influencer

amtm,

I do not have access to an ESS installation. However normally to add a view/dropdown to the navigation, you would navigate to the App's navigational view area (i.e. ESS App >> Manager >> User Interface >> Navigation menus), and modify the "default.xml".

It's a pretty simple XML to add you view simply to the navigation bar add something like:

<view name="yourview" />

Probably best to add this at the very beginning or the very end.. so that it doesn't intefer with the core functionality.

Best practice would say to back the XML to a text file, "just in case".

Regards,

MHibbin

View solution in original post

jbillings
Path Finder

Very late to the party for this one, but from the Home page in the Enterprise Security App, select App configuration. This will take you to the ES Configuration. Under General, select Navigation. This will let you edit/add views to the menu.
Regards,
jbillings

0 Karma

MHibbin
Influencer

amtm,

I do not have access to an ESS installation. However normally to add a view/dropdown to the navigation, you would navigate to the App's navigational view area (i.e. ESS App >> Manager >> User Interface >> Navigation menus), and modify the "default.xml".

It's a pretty simple XML to add you view simply to the navigation bar add something like:

<view name="yourview" />

Probably best to add this at the very beginning or the very end.. so that it doesn't intefer with the core functionality.

Best practice would say to back the XML to a text file, "just in case".

Regards,

MHibbin

MHibbin
Influencer

cool, nice one!

0 Karma

amtm
Engager

That did the trick! Thank you very much. I added this code at the end:

<collection label="Custom Dashboards">
<view name="_new_test_dashboard"/>
</collection>
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...