Splunk ITSI

ITSI - An unknown view name "search" is referenced in the navigation definition for "itsi" - View customization

edoardo_vicendo
Builder

Hello,

I am trying to remove some views from the app, so that the simple users can only see dashboards. To do that I have created a new user with Role = "user_read_only" (created by me with capabilities inherit by Role = "user"), then from Settings >> User Interface >> Views I have removed the read permission to the following views for "user_read_only" and "user":

  • Search
  • Datasets
  • Reports
  • Alerts

And then in Settings >> User Interface >> Navigation Menu, modified the xml to have the Dashboards view as default.
So that the result is the following (only Dashboards menu is showed):

alt text

Until now everthing was working as per the expectation, but this simple user should also access to ITSI application.
For this reason I added "itoa_user" and "user_ad_user" to the "user_read_only" Role.
When Clicking in the ITSI link from App menu the page crash:

alt text

So doing a search in the index="_internal" with the given request ID, it shows several errors like:

An unknown view name "search" is referenced in the navigation definition for "itsi"
source =    /opt/splunk/var/log/splunk/web_service.log
sourcetype =    splunk_web_service

Do you know if there is a way to remove the Search view from my app and do not let ITSI crash with the above error message?

Thanks a lot,
Edoardo

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...