Organising user defined searches into subfolders

[joejag]

I would like to organise my saved searches into subfolders in the drop down on the search app.

I noticed that the "Errors" subfolder exists with "Errors in the last hour" etc. Is is possible to do this with user defined searches?

[lguinn2]

Yes! You can control the menus in the default "nav" file for each app. For the search app, go to

Manager » User interface » Navigation menus

Choose the App context of search, and you should see a single Nav name listed, called "default."
You can edit default directly, but I recommend that you clone it to "default_save" first, just in case.
Then click on "default" to open the XML file.

The search navigation menu is actually pretty complex; look near the bottom, and you can see the xml that looks like

<collection label="Errors">
    <saved source="unclassified" match="error" />
</collection>

This is the XML that groups the saved searches about "errors" into a sub-menu. A collection is a menu or sub-menu in the nav. The "saved" element denotes a list of saved searches, and the match element specifies that the list consists of searches with the word "error" in their names. You can add any number of similar entries, categorizing the searches as you wish. (You can only have two levels of menu, though.)

For more information, see this page on navigation in the Splunk Developer manual.

[joejag]

Thanks for the additional answer!

[rroberts · Accepted solution]

Yes, it is possible. The default.xml navigation file there are 3 collections options out-of-the-box, error, admin and inputs. You can "classify" your own with the match attribute.
Check out.. http://docs.splunk.com/Documentation/Splunk/4.2.4/Developer/Step6BuildNavigation