Dashboards & Visualizations

Navigation Menu xml Match Help

I-Man
Communicator

In the Default Search Nav Menu I am trying to match all of my Active Directory reports so they are Nested in "AD Reports". All of the reports start with "AD ". The issue i'm running into is that other reports that have "AD " are matching such as "Dead Hosts".

<collection label="AD Reports">
  <saved source="unclassified" match="AD " />
</collection>

I searched for anything about xml and match but could not find any rules or ways to use regex. Any ideas about how to specify a match?

Similar to a question asked by Glenn, what characters are we allowed to use to specify the match?:

http://answers.splunk.com/questions/4288/is-it-possible-to-match-views-in-app-menu-using-wildcards-o...

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The match is a simple case-insensitive substring match, so unfortunately no regex or anything else special is available here.

View solution in original post

brettcave
Builder

Until regex matching is brought in, the next-best approach would probably be changing your naming convention, like starting all reports with _ and then matching on "_AD ".

not the most elegant solution, but might work.

0 Karma

brettcave
Builder

and on playing with this, when matching, it matches on the name of a view, not the display name, so you could rename all your views to __ad__foo and leave the display name as "AD Foo"

0 Karma

Starlette
Contributor

This sounds like a mod request? ( to use regex)

brettcave
Builder

+1000 on this!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The match is a simple case-insensitive substring match, so unfortunately no regex or anything else special is available here.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...