Here's the answer I got when following up with Nick: "The simplest way to end up with nice @go url's was to use a trick I've been using in custom app development, where I just put a NullModule in a view, and in that view I then redefine NullModule to have some specific behavior that I want." Here are the snippets of code to make it work. Move etc/apps/search/default/data/ui/views/dashboard.xml to etc/apps/search/local/ui/views/ and add the following before the final . If you use this in another app, you must change search to reflect the name of your app. <!-- begin addition --> <!-- saved search panel --> <module name="StaticContentSample" layoutPanel="panel_row3_col1" group="Saved Searches"> <param name="text"> This lists all of the saved searches you have created and/or have access to see. <a href="https://answers.splunk.commanager/search/saved/searches">Edit saved searches</a> via Manager. </param> </module> <!-- The first list of searches - Search View --> <module name="GenericHeader" layoutPanel="panel_row3_col1"> <param name="label">Open in Search View</param> </module> <module name="Sorter" layoutPanel="panel_row3_col1_grp1"> <param name="sortKey">name</param> <param name="sortDir">asc</param> <param name="fields"> <list> <param name="label">Name</param> <param name="value">name</param> </list> </param> <module name="Paginator"> <param name="count">15</param> <param name="entityName">settings</param> <param name="maxPages">10</param> <module name="EntityLinkLister"> <param name="count">15</param> <param name="entityPath">/saved/searches</param> <param name="namespace">search</param> <param name="settingToCreate">savedSearchName</param> <param name="entityFieldsToDisplay"> <list> <param name="label">name</param> <param name="value">name</param> </list> </param> <!-- Instead of the normal stack of HiddenSearch + ConvertToIntention + ViewRedirector, which cant do what we want, we instead place a NullModule and then we customize it to do exactly what we want. See application.js --> <module name="NullModule"/> </module> </module> </module> The other snippet must be added to etc/apps/search/appserver/static/application.js. This snippet will be the entire file if it does not yet exist. Replace case "dashboard" : with the name of your view, if you are not adding to dashboard.xml. switch (Splunk.util.getCurrentView()) { case "dashboard" : // PATCH 1 // -- the entityLinkLister does not stop framework pushes. if (Splunk.Module.EntityLinkLister) { Splunk.Module.EntityLinkLister= $.klass(Splunk.Module.EntityLinkLister, { onUserAction: function($super, event) { $super(event); this.pushContextToChildren(null, true); }, pushContextToChildren: function($super, explicitContext, simonSays) { if (!this.isPageLoadComplete || simonSays) { $super(explicitContext); } } }); } // PATCH 2 - Neither ViewRedirector nor anyone else // allows you to redirect a saved search link such that // the displayView and the timerange are set correctly. if (Splunk.Module.NullModule) { Splunk.Module.NullModule= $.klass(Splunk.Module.NullModule, { onContextChange: function() { var context = this.getContext(); var savedSearchName = context.get("savedSearchName"); Splunk.util.redirect_to("/app/" + Splunk.util.getCurrentApp() + "/@go?s=" + encodeURIComponent(savedSearchName)); } }); } break; } ... View more

I wrestled with this for a bit when trying to aggregate a particular day of the week's values over a month, and display the "average week" for the month. I could count by date_wday, but it the x axis would always be sorted lexigraphically. Very confusing. Here's my solution: use the eval to make a field with both a number for ordering as well as the name for easy viewing: search ..... | eval Day = if(date_wday="sunday","1. Sunday",if(date_wday="monday","2. Monday",if(date_wday="tuesday","3. Tuesday",if(date_wday="wednesday","4. Wednesday",if(date_wday="thursday","5. Thursday",if(date_wday="friday","6. Friday",if(date_wday="saturday","7. Saturday",0)))))))| chart count over Day ... View more

There is an option to pass to transaction to make the mv field comply with event order: searchquery | transaction foo maxspan=5m maxpause=1m delim="," mvlist=bar | eval LastBar=mvindex(bar, -1) This will create the multivalue bar field in event order. You can also specify mvlist=true to apply event-order to all mv fields created by transaction. ... View more