Splunk IT Service Intelligence

ITSI - An unknown view name "search" is referenced in the navigation definition for "itsi" - View customization



I am trying to remove some views from the app, so that the simple users can only see dashboards. To do that I have created a new user with Role = "user_read_only" (created by me with capabilities inherit by Role = "user"), then from Settings >> User Interface >> Views I have removed the read permission to the following views for "user_read_only" and "user":

  • Search
  • Datasets
  • Reports
  • Alerts

And then in Settings >> User Interface >> Navigation Menu, modified the xml to have the Dashboards view as default.
So that the result is the following (only Dashboards menu is showed):

alt text

Until now everthing was working as per the expectation, but this simple user should also access to ITSI application.
For this reason I added "itoa_user" and "user_ad_user" to the "user_read_only" Role.
When Clicking in the ITSI link from App menu the page crash:

alt text

So doing a search in the index="_internal" with the given request ID, it shows several errors like:

An unknown view name "search" is referenced in the navigation definition for "itsi"
source =    /opt/splunk/var/log/splunk/web_service.log
sourcetype =    splunk_web_service

Do you know if there is a way to remove the Search view from my app and do not let ITSI crash with the above error message?

Thanks a lot,

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...