Splunk ITSI

ITSI - An unknown view name "search" is referenced in the navigation definition for "itsi" - View customization

edoardo_vicendo
Contributor

Hello,

I am trying to remove some views from the app, so that the simple users can only see dashboards. To do that I have created a new user with Role = "user_read_only" (created by me with capabilities inherit by Role = "user"), then from Settings >> User Interface >> Views I have removed the read permission to the following views for "user_read_only" and "user":

  • Search
  • Datasets
  • Reports
  • Alerts

And then in Settings >> User Interface >> Navigation Menu, modified the xml to have the Dashboards view as default.
So that the result is the following (only Dashboards menu is showed):

alt text

Until now everthing was working as per the expectation, but this simple user should also access to ITSI application.
For this reason I added "itoa_user" and "user_ad_user" to the "user_read_only" Role.
When Clicking in the ITSI link from App menu the page crash:

alt text

So doing a search in the index="_internal" with the given request ID, it shows several errors like:

An unknown view name "search" is referenced in the navigation definition for "itsi"
source =    /opt/splunk/var/log/splunk/web_service.log
sourcetype =    splunk_web_service

Do you know if there is a way to remove the Search view from my app and do not let ITSI crash with the above error message?

Thanks a lot,
Edoardo

0 Karma
Get Updates on the Splunk Community!

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...