Why is the default.xml of my app picking up saved searches from other applications and how do I fix this?

[wegscd]

I'm trying to do a quick-and-dirty app that just has navigation to some saved searches.

<nav search_view="search" color="#800000">
  <view name="search" default='true' />
  <saved name="# of users by function"/>
  <collection label="Other Saved Reports">
    <saved source="unclassified" />
  </collection>
</nav>

The problem I am having is that

<saved source="unclassified"/>

is picking up saved searches from other applications. I only want the ones from my application. Is there something I can add to the <saved> tag to do this?

I know I can use match="", but that still leaves me vulnerable to someone saving a search in another app that happens to match the pattern, so I do not want to go there.

[MuS · Accepted solution]

Hi wegscd,

those other saved searches are probably shared over all apps.
So, you need to change the permission of those other saved searches to app only, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutsavingandsharingreports#Find_a...

cheers, MuS

[ChloeMica]

That's the problem? Well, I will try.

[wegscd]

yes, that's the problem. Those other saved searches are parts of SAs (SA-NIX, the CIM SA), and the applications are said to break if you don't share their searches globally.

It appears that you use those SAs, or you can use <saved source="unclassified">;, but you can't do both.

So back to the question: is there a workaround to keep <saved source="unclassified">from picking up other app's searches?

If only we had <saved application="..." source="unclassified"> to help keep applications out of each others hair.

[MuS]

The only way to restrict the views listed is to use the match option like this:

<view source="unclassified" match="dashboard"/>

This will only show dashboards which contains the name dashboard but still shows them if they are shared globally in another app.