Reporting

How can I hide a saved search?

Simeon
Splunk Employee
Splunk Employee

I have a lot of saved searches that populate my summary index and I do not want them to be viewable in the saved search pull down (drop-down) menu. Is there a way for me to hide or remove these searches from the pull down navigation?

I realize I can hide them by putting them in another app, not sharing the search, or classifying a few of them under a specific label, but I'd prefer to just have them hidden.

Tags (1)
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

You can set is_visible=false in savedsearches.conf for the particular saved searches you don't want to show

$SPLUNK_HOME/etc/system/README/savedsearches.conf.spec
...
is_visible = <bool>
* whether this saved search should be listed in the visible saved search list
* Defaults to true

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

You can set is_visible=false in savedsearches.conf for the particular saved searches you don't want to show

$SPLUNK_HOME/etc/system/README/savedsearches.conf.spec
...
is_visible = <bool>
* whether this saved search should be listed in the visible saved search list
* Defaults to true

sideview
SplunkTrust
SplunkTrust

Nice. I didnt know about this. It does work to hide the saved search from the users' app menus. And it does leave the saved search still visible in Manager which is even better. (in this case Simeon wanted the admins to still be able to edit/clone things in the UI)

0 Karma

Lowell
Super Champion

I've resorted do doing the permission thing with my summary index searches. I've also tried the submenu thing (you know, name the menu "Summary Index -- DO NOT RUN --", which looks great and leads to no unwanted questions. right.) In combination it's not too bad. The menu disappears if the user doesn't have access.

I agree that it really seems like there should really be an easer/better way to do this. I like how views have the isVisible option. I wish something like this were possible with searches.

Does anyone know if this has been officially submited as a feature request?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...