Splunk Enterprise Security

ESS - Simple saved dashboard question

amtm
Engager

Within the ESS application, I created a simple saved dashboard based upon a search:
Splunk -> ESS -> Search
Specify search query -> Actions -> Add to dashboard

After going through the menu, and creating a new dashboard, naming the panel, etc, I had a tough time finding the newly created dashboard. It does not show up in a 'View' menu like the search app; However I was able to see the dashboard in the 'Manage Views' config menu (navigating through the search app). The app context was listed as SplunkESS, so I found I was able to get to the newly created dashboard by navigating to it via url/name directly:

https://mysplunkess:8000/en-US/app/SplunkEnterpriseSecuritySuite/_new_test_dashboard

The dashboard shows correctly, and I am able to edit it. However what I would like to do is have a link to this dashboard within ESS; so it shows up as a clickable menu item in the black navigation bar. When I go to the Domain / Dashboard config menu (Splunk > ESS > Configure > Domains / Dashboards) I do not see my '_new_test_dashboard' dashboard listed. Is there a conf file that needs to be edited directly?

0 Karma
1 Solution

MHibbin
Influencer

amtm,

I do not have access to an ESS installation. However normally to add a view/dropdown to the navigation, you would navigate to the App's navigational view area (i.e. ESS App >> Manager >> User Interface >> Navigation menus), and modify the "default.xml".

It's a pretty simple XML to add you view simply to the navigation bar add something like:

<view name="yourview" />

Probably best to add this at the very beginning or the very end.. so that it doesn't intefer with the core functionality.

Best practice would say to back the XML to a text file, "just in case".

Regards,

MHibbin

View solution in original post

jbillings
Path Finder

Very late to the party for this one, but from the Home page in the Enterprise Security App, select App configuration. This will take you to the ES Configuration. Under General, select Navigation. This will let you edit/add views to the menu.
Regards,
jbillings

0 Karma

MHibbin
Influencer

amtm,

I do not have access to an ESS installation. However normally to add a view/dropdown to the navigation, you would navigate to the App's navigational view area (i.e. ESS App >> Manager >> User Interface >> Navigation menus), and modify the "default.xml".

It's a pretty simple XML to add you view simply to the navigation bar add something like:

<view name="yourview" />

Probably best to add this at the very beginning or the very end.. so that it doesn't intefer with the core functionality.

Best practice would say to back the XML to a text file, "just in case".

Regards,

MHibbin

MHibbin
Influencer

cool, nice one!

0 Karma

amtm
Engager

That did the trick! Thank you very much. I added this code at the end:

<collection label="Custom Dashboards">
<view name="_new_test_dashboard"/>
</collection>
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...