aliasing saved searches in a menu

[anssntaco]

Is it possible to alias saved searches in the navigation menu?

In default.xml, I list specific saved searches. Some of the saved search names are pretty long, and since the collection groupings already provide a fair amount of drilldown into the nature of the search, I'd like to be able to refer to it in a more shorthanded way?

For example, let's say I have a saved search called "search for x in component y". There are a # of saved searches on component y, so i created a collection named "y" in the navigation menu. Without changing the name of the saved search, in the navigation menu, I'd like the user to see the alias "search for x".

[sideview · Accepted solution]

You can actually put raw link tags directly into the default.xml. For instance

<a href="/some_view">Go to that view that you like</a>

However Splunk doesn't know that this represents the <view>, so to then prevent the generic link from being rendered out a second time by the unassigned node, you have to mark the view with isVisible="False", which is a bit unintuitive.

It might not be what you're looking for cause you'll end up managing a big chunk of HTML in default.xml, but it can work in a pinch.

[Sqig]

Maros may be the way to go. Create a macro that does the search you want, then create a new saved search with the shorter name and reference the macro.

http://docs.splunk.com/Documentation/Splunk/4.3.2/User/CreateAndUseSearchMacros