Why does my saved search not appear in the navigation bar on a dashboard?

[tkreiner]

I am building out the navigation bar for an app. It appears as follows:

<nav color="#778899">
<view name="my_dashboard" default='true' />
<view name="search" />
<view name="dashboards" />
<saved name="My Saved Search" />
</nav>

When I go to the app, I only see menu items for my_dashboard, search, and dashboards. The saved search doesn't appear. HOWEVER, if I go to search or dashboards, my saved search menu item suddenly appears in the navigation bar and works correctly.

How can I get the saved search menu item to appear in all areas of the application, including when I am on the dashboard?

[FRoth]

I have found a workaround.
Problem still exists in all Splunk versions since version 6.3.4 (see my comments to the initial questions).

If I add the following section to my "default.xml" ...

  <collection label="All Analysis Views">
    <saved source="unclassified" />
  </collection>

... both the new section with all unclassified saved searches and the other menu with my selected searches appear.
Removing the section again and both sections disappear.
I reproduced this behaviour with my THOR App version 1.2.1, which I will update soon to fix this nasty bug with the workaround.

Again - that's the behaviour:

Not showing

   <collection label="Analysis"> <!-- <<< does not show up in Overview Dashboard -->
     <saved name="Base Analysis" default="true" /> <!-- <<< does not show up in Overview Dashboard -->
     <saved name="Rare Warnings and Alerts" />  <!-- <<< does not show up in Overview Dashboard -->
   </collection>

Showing both menu elements

  <collection label="All Analysis Views">
    <saved source="unclassified" />
  </collection> 
  <collection label="Analysis"> <!-- <<< shows up in Overview Dashboard -->
     <saved name="Base Analysis" default="true" /> <!-- <<< shows up in Overview Dashboard -->
     <saved name="Rare Warnings and Alerts" />  <!-- <<< shows up in Overview Dashboard -->
   </collection>

I wonder why no one else has reported this issue since the version 6.3.4 release?

[FRoth]

I do have the exact same problem here. Everyting worked fine in version 6.2 but I upgraded to version 6.4 recently. All the saved searches (reports) navigation bar elements show up in search views but not in the dashboard views.

I noticed that the value "request.ui_dispatch_view" is set to "search" by default. Removing it doesn't solve the issue.
I'll downgrade to version 6.2 to see if the problem is related to version 6.4.

default.xml

<nav search_view="search" color="#333333">
  <!-- <view name="search"/> -->
  <collection label="Dashboards">
    <view name="overview" default="true" />
  </collection>
  <collection label="Analysis"> <!-- <<< does not show up in Overview Dashboard -->
    <saved name="Base Analysis" default="true" /> <!-- <<< does not show up in Overview Dashboard -->
    <saved name="Rare Warnings and Alerts" />  <!-- <<< does not show up in Overview Dashboard -->
  </collection>
  <view name="data_models" />  
  <collection label="Testing">  
    <view name="simple_search"/>  <!-- <<< Clicking this view shows the Analysis Drop Down -->
  </collection> 
</nav>

savedsearches.conf

[Base Analysis]
action.email.reportServerEnabled = 0
action.email.useNSSubject = 1
alert.track = 0
description = Basic search to build useful search statements upon
dispatch.earliest_time = 0
display.events.fields = ["system","level","mainreason","duration","source","sourcetype","host","session_id","eventtype","score","module","matching_strings","message"]
display.general.type = statistics
display.page.search.tab = statistics
display.visualizations.chartHeight = 233
display.visualizations.show = 0
request.ui_dispatch_app = thor
request.ui_dispatch_view = search
search = eventtype=events NOT tag=false_positive ( level=Alert OR level=Warning ) | table system,module,score,mainreason,file,_raw

[FRoth]

This is a bug. How do I report bugs?

[FRoth]

Verified - this error exists since version 6.3.4.
My app works fine in
6.2.4
6.2.9
6.3.0
6.3.1
6.3.2
6.3.3
(yes, I've downloaded and installed them all)

I also cross-checked for statements that are marked as obsolete here

and the known issues in 6.3.4 here

[jkat54]

I think this will fix it:

 <nav color="#778899">
  <view name="my_dashboard" default='true' >
  <saved name="My Saved Search" />
  </view>
  <view name="search">
  <saved name="My Saved Search" />
  </view>
  <view name="dashboards" >
  <saved name="My Saved Search" />
  </view>
  </nav>

Or some combo thereof. I hope you can see/understand the difference in my XML vs yours and then solve accordingly. Well that and I hope it solves the problem and I don't look silly trying to help!!!

[NOUMSSI]

Hi,
verify that that saved searche has not a private. assure you that the saved searche has a good right

[tkreiner]

I checked and the search is shared to the App. Everyone group has read privileges and admin group has write privilege. So that doesn't appear to be the issue.

Also, I would think that if it were permissions issues, I wouldn't be able to see it all. But I can definitely see it when I'm in the context of the Search app.

Any other ideas?