Reporting

How can I hide a collection of saved searches?

ftk
Motivator

I have a number of searches updating summary indexes that I do not want to show up in my app' s navigation UI under Searches & Reports.

I can use the isVisible="false" tag to hide views in the navigation menu, but the same tag doesn't appear to work for collections. I am aware that I can use is_visible=false in savedsearches.conf, but I would prefer not to have to do that manually for every search I want to hide.

What options do I have to hide groups of saved searches in the UI?

Tags (3)
1 Solution

sideview
SplunkTrust
SplunkTrust

The default.xml file aka the app navigation cannot hide whole collections of searches and views. As you've discovered, you can put isVisible="false" in the individual view xml files, and/or in the individual saved searches.

However you can also make views and saved searches visible or invisible to different users depending on the users' roles.

There may be a better docs link than this one, but here's a link to the relevant section in the developer manual. http://www.splunk.com/base/Documentation/4.1.3/Developer/Step5SetPermissions

And I dont recommend it, but if setting read-access by role wasnt an option for some reason you could at a pinch define a collection in the nav and then use custom CSS to make that particular menu item invisible and inaccessible in the UI. Sort of a roach motel collection.

some "custom CSS" elaboration:

here are the general docs about custom css http://www.splunk.com/base/Documentation/latest/Developer/UseCSS

and if your menu item you wanted to banish was the 3rd item in the menu i believe the particular CSS would be:

#navmenu_2 {
    display:none;
}

View solution in original post

sideview
SplunkTrust
SplunkTrust

The default.xml file aka the app navigation cannot hide whole collections of searches and views. As you've discovered, you can put isVisible="false" in the individual view xml files, and/or in the individual saved searches.

However you can also make views and saved searches visible or invisible to different users depending on the users' roles.

There may be a better docs link than this one, but here's a link to the relevant section in the developer manual. http://www.splunk.com/base/Documentation/4.1.3/Developer/Step5SetPermissions

And I dont recommend it, but if setting read-access by role wasnt an option for some reason you could at a pinch define a collection in the nav and then use custom CSS to make that particular menu item invisible and inaccessible in the UI. Sort of a roach motel collection.

some "custom CSS" elaboration:

here are the general docs about custom css http://www.splunk.com/base/Documentation/latest/Developer/UseCSS

and if your menu item you wanted to banish was the 3rd item in the menu i believe the particular CSS would be:

#navmenu_2 {
    display:none;
}

ftk
Motivator

Can you please elaborate on the custom CSS you refer to in your last paragraph?

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...