Splunk Enterprise Security
Highlighted

ESS - Simple saved dashboard question

Engager

Within the ESS application, I created a simple saved dashboard based upon a search:
Splunk -> ESS -> Search
Specify search query -> Actions -> Add to dashboard

After going through the menu, and creating a new dashboard, naming the panel, etc, I had a tough time finding the newly created dashboard. It does not show up in a 'View' menu like the search app; However I was able to see the dashboard in the 'Manage Views' config menu (navigating through the search app). The app context was listed as SplunkESS, so I found I was able to get to the newly created dashboard by navigating to it via url/name directly:

https://mysplunkess:8000/en-US/app/SplunkEnterpriseSecuritySuite/_new_test_dashboard

The dashboard shows correctly, and I am able to edit it. However what I would like to do is have a link to this dashboard within ESS; so it shows up as a clickable menu item in the black navigation bar. When I go to the Domain / Dashboard config menu (Splunk > ESS > Configure > Domains / Dashboards) I do not see my 'newtest_dashboard' dashboard listed. Is there a conf file that needs to be edited directly?

0 Karma
Highlighted

Re: ESS - Simple saved dashboard question

Influencer

amtm,

I do not have access to an ESS installation. However normally to add a view/dropdown to the navigation, you would navigate to the App's navigational view area (i.e. ESS App >> Manager >> User Interface >> Navigation menus), and modify the "default.xml".

It's a pretty simple XML to add you view simply to the navigation bar add something like:

<view name="yourview" />

Probably best to add this at the very beginning or the very end.. so that it doesn't intefer with the core functionality.

Best practice would say to back the XML to a text file, "just in case".

Regards,

MHibbin

View solution in original post

Highlighted

Re: ESS - Simple saved dashboard question

Engager

That did the trick! Thank you very much. I added this code at the end:

<collection label="Custom Dashboards">
<view name="_new_test_dashboard"/>
</collection>
Highlighted

Re: ESS - Simple saved dashboard question

Influencer

cool, nice one!

0 Karma
Highlighted

Re: ESS - Simple saved dashboard question

SplunkTrust
SplunkTrust

Very late to the party for this one, but from the Home page in the Enterprise Security App, select App configuration. This will take you to the ES Configuration. Under General, select Navigation. This will let you edit/add views to the menu.
Regards,
jbillings

0 Karma