Reporting

aliasing saved searches in a menu

anssntaco
Path Finder

Is it possible to alias saved searches in the navigation menu?

In default.xml, I list specific saved searches. Some of the saved search names are pretty long, and since the collection groupings already provide a fair amount of drilldown into the nature of the search, I'd like to be able to refer to it in a more shorthanded way?

For example, let's say I have a saved search called "search for x in component y". There are a # of saved searches on component y, so i created a collection named "y" in the navigation menu. Without changing the name of the saved search, in the navigation menu, I'd like the user to see the alias "search for x".

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

You can actually put raw link tags directly into the default.xml. For instance

<a href="/some_view">Go to that view that you like</a>

However Splunk doesn't know that this represents the <view>, so to then prevent the generic link from being rendered out a second time by the unassigned node, you have to mark the view with isVisible="False", which is a bit unintuitive.

It might not be what you're looking for cause you'll end up managing a big chunk of HTML in default.xml, but it can work in a pinch.

View solution in original post

sideview
SplunkTrust
SplunkTrust

You can actually put raw link tags directly into the default.xml. For instance

<a href="/some_view">Go to that view that you like</a>

However Splunk doesn't know that this represents the <view>, so to then prevent the generic link from being rendered out a second time by the unassigned node, you have to mark the view with isVisible="False", which is a bit unintuitive.

It might not be what you're looking for cause you'll end up managing a big chunk of HTML in default.xml, but it can work in a pinch.

Sqig
Path Finder

Maros may be the way to go. Create a macro that does the search you want, then create a new saved search with the shorter name and reference the macro.

http://docs.splunk.com/Documentation/Splunk/4.3.2/User/CreateAndUseSearchMacros

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...