We just got updated from version 5.0.8, to 6.1.3, and I am not happy at all with the new behavior of the menu navigation.
In version 5, when mousing over a menu item which points to a submenu, the submenu would appear, let you navigate to the next submenu while keeping the previous one open. There was no need to click, and it allowed you to keep track of the path you followed. You could also quickly take a screenshot to send to coworkers to let them know where the new dashboard was. In version 6, you have to click on a menu item which points to a submenu. This shifts the box to the submenu, in such a way that you never can see where you came from. And you have to click every time you want to navigate all the submenus.
Is it possible to change this behavior back to that of version 5?
I recently came across this question:
http://answers.splunk.com/answers/140375/cascading-menus-for-nested-navigation.html
which made me realize that the proper term to describe the menu I want is "cascading menu".
Well, I took a look at the doc but didn't see anything having to do with cascading menus. It does mention the nesting, and the limitation of 2 levels. The strange thing is that I have a menu nested at 3 levels and it works. But it's not cascading. So my question remains.
You can edit the XML for the Search app, as jtrucks suggests in this previous Splunk Answers posting.
You could also replace the 6.1 Search app with the 5.0.8 one, as described in this previous posting.
Note that these types of changes are not supported, and will not persist in your next upgrade. But if you want to experiment with them, you can.
It's valid criticism, but it will be more effective if delivered as an ER for the core type of functionality you want/need.
(I'm not sure the 5.x implementation was even optimal. I think this comes down to rapid access to a large number of visually categorized and organized searches? Just a guess.)
In addition, you can also provide an expression of the pain associated with the loss of this functionality via sales.
hahahahhh...yeah, right, like my Enhancement Requests have been listened to before. I remember distinctly requesting that "All time" not be set as a default value in new splunk installs. But, when we upgraded to 6.1.3, that's exactly what it did. It sets all our search heads time range selection to "All time"!
Does anyone at splunk realize what happens when newbies just launch an "all time" search in a system that has 3+ years worth of data (more than 100 TB)?
Regarding your comment about "providing the expression of pain associated with the loss of this functionality via sales", it's downright silly. We are the customers, we really need to view our data with Splunk, and if we say that this change in functionality is inconvenient, that should be enough.
You are correct...there is no easy (and supported, and maintainable) way to do this.
huh revert to 5.0.8? Of course nobody would want to do that.
And jtrucks' suggestion means editing the app js/css. Nice and easy? NOT.
I guess I don't have time for this. My conclusion: there is no easy way to do this. Oh well... like I said: "one step forward, two steps backward".