All Apps and Add-ons

Default Alerts dashboard replaced by Splunk app for *nix

faustf
Communicator

Hi guys,
I've created my custom Splunk Application.
After that I've installed the Splunk App for unix and linux I noticed that the default Alert dashboard (which lists the configured alerts defined by app) has been replaced by the one defined in Splunk App for unix and linux

My data/ui/nav/default.xml is the following:

<nav search_view="search" color="#345790">
 <view name="home_view"  default='true'/>
  <view name="view1" />
  <view name="view2" />
  <view name="alerts" />
  <view name="reports" />
  <view name="search" />      
  <view name="dashboards" />
  <view name="datasets" />
</nav>

but If I click on alerts the following dashboard appears:
alt text

Also in the Dahsboard view I see that there is a Dashboard called "Alerts" defined by splunk_app_for_nix

How can I configure my data/ui/nav/default.xml to load the default Alerts dashboard in my Customized application instead of the one defined by splunk_app_for_nix ?

Thanks

alt text

0 Karma
1 Solution

bohanlon_splunk
Splunk Employee
Splunk Employee

This appears to be an issue with the global export permissions on the splunk_app_for_unix taking precedence over the default navigation options of the barebones template used in your custom app:
Splunk internal engineering reference = TAG-12427

Workaround:
Settings/User Interface/Views
Fix the Unix app permission from "Global" to "App only".

Settings/User Interface/Navigation Menus
Fix the Unix app permission from "Global" to "App only".

Bump the server.

View solution in original post

bohanlon_splunk
Splunk Employee
Splunk Employee

This appears to be an issue with the global export permissions on the splunk_app_for_unix taking precedence over the default navigation options of the barebones template used in your custom app:
Splunk internal engineering reference = TAG-12427

Workaround:
Settings/User Interface/Views
Fix the Unix app permission from "Global" to "App only".

Settings/User Interface/Navigation Menus
Fix the Unix app permission from "Global" to "App only".

Bump the server.

jplumsdaine22
Influencer

Looks like this isn't limited to Unix App. Any app that has global permissions for the nav bar will override the search/default/data/ui/nav/default.xml nav bar.

We had several apps with this problem. We had to both change the share permissions to App for all navs and set the permissions for the search app nav to Global to resolve the issue.

0 Karma

mlconnor
Explorer

Now that I turned that off, I don't get the fields for the Nix search. I suspect that's because change the permissions to app only kills the field extractions.

0 Karma

mlconnor
Explorer

This fixed my issue. Thank you so much. I literally spent about 10 hours trying to solve this.

0 Karma

eguswes
Explorer

Also had this problem, and this solved it for me! grazie!

0 Karma

faustf
Communicator

no one can help me?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...