topic Re: Why is the default.xml of my app picking up saved searches from other applications and how do I fix this? in Reporting

Why is the default.xml of my app picking up saved searches from other applications and how do I fix this?

wegscd — Thu, 23 Jul 2015 17:19:12 GMT

I'm trying to do a quick-and-dirty app that just has navigation to some saved searches.

<nav search_view="search" color="#800000">
  <view name="search" default='true' />
  <saved name="# of users by function"/>
  <collection label="Other Saved Reports">
    <saved source="unclassified" />
  </collection>
</nav>

The problem I am having is that

<saved source="unclassified"/>

is picking up saved searches from other applications. I only want the ones from my application. Is there something I can add to the <saved> tag to do this?

I know I can use match="", but that still leaves me vulnerable to someone saving a search in another app that happens to match the pattern, so I do not want to go there.

Re: Why is the default.xml of my app picking up saved searches from other applications and how do I fix this?

MuS — Fri, 24 Jul 2015 01:50:10 GMT

Hi wegscd,

those other saved searches are probably shared over all apps.
So, you need to change the permission of those other saved searches to app only, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutsavingandsharingreports#Find_and_share_saved_reports

cheers, MuS

Re: Why is the default.xml of my app picking up saved searches from other applications and how do I fix this?

wegscd — Fri, 24 Jul 2015 12:17:39 GMT

yes, that's the problem. Those other saved searches are parts of SAs (SA-NIX, the CIM SA), and the applications are said to break if you don't share their searches globally.

It appears that you use those SAs, or you can use <saved source="unclassified">;, but you can't do both.

So back to the question: is there a workaround to keep <saved source="unclassified">from picking up other app's searches?

If only we had <saved application="..." source="unclassified"> to help keep applications out of each others hair.

Re: Why is the default.xml of my app picking up saved searches from other applications and how do I fix this?

MuS — Sun, 26 Jul 2015 20:45:38 GMT

The only way to restrict the views listed is to use the match option like this:

<view source="unclassified" match="dashboard"/>

This will only show dashboards which contains the name dashboard but still shows them if they are shared globally in another app.

Re: Why is the default.xml of my app picking up saved searches from other applications and how do I fix this?

ChloeMica — Mon, 27 Jul 2015 03:31:53 GMT

That's the problem? Well, I will try.