Splunk IT Service Intelligence

ITSI - An unknown view name "search" is referenced in the navigation definition for "itsi" - View customization

edoardo_vicendo
Contributor

Hello,

I am trying to remove some views from the app, so that the simple users can only see dashboards. To do that I have created a new user with Role = "user_read_only" (created by me with capabilities inherit by Role = "user"), then from Settings >> User Interface >> Views I have removed the read permission to the following views for "user_read_only" and "user":

  • Search
  • Datasets
  • Reports
  • Alerts

And then in Settings >> User Interface >> Navigation Menu, modified the xml to have the Dashboards view as default.
So that the result is the following (only Dashboards menu is showed):

alt text

Until now everthing was working as per the expectation, but this simple user should also access to ITSI application.
For this reason I added "itoa_user" and "user_ad_user" to the "user_read_only" Role.
When Clicking in the ITSI link from App menu the page crash:

alt text

So doing a search in the index="_internal" with the given request ID, it shows several errors like:

An unknown view name "search" is referenced in the navigation definition for "itsi"
source =    /opt/splunk/var/log/splunk/web_service.log
sourcetype =    splunk_web_service

Do you know if there is a way to remove the Search view from my app and do not let ITSI crash with the above error message?

Thanks a lot,
Edoardo

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...