Define navigation to saved searches and reports
Contents
As a knowledge manager you should ensure that your saved searches and reports appear in the top-level navigation menus of your Splunk apps in a logical manner that facilitates ease of discovery. To do this you need to customize the navigation menus for your apps. If you fail to attend to your navigation menus, over time they may become overlong and inefficient, as saved searches and reports are added without subsequent categorization.
To manage the way your searches are saved and organized in the top-level navigation menu for an app, you need to work with the code behind the nav menu. When you do this, keep in mind that the nav code refers to lists of searches and reports as collections.
The following subtopics describe various things you can do to organize your saved search and reports listings in the top-level navigation menu. For details on how to adjust the XML code for the navigation menu, see "Build navigation for your app" in the Developer manual.
Set up a default collection
Each app should have a default collection set up for "unclassified" searches. Unclassified searches are any searches that haven't been explicitly identified in the nav menu code. This is the collection in which all newly saved searches appear. In the Search app, for example, the default collection is Searches & Reports.
If you do not set up a default collection, you will have to manually add saved searches to the nav code to see them in your app's top-level navigation menu.
Note: A default collection should also be set up for unclassified views and dashboards.
Organize saved searches in nested collections
As the number of saved searches and reports that are created for an app grows, you're going to want to find ways to organize those searches in a logical manner. You can manually construct collections that group lists together by function. Going further, you can set up nested collections that subdivide large collections into groups of smaller ones.
In the Search app, nested collections are used to group similar types of searches together:
Dynamically group together saved searches
Collections can be set up to dynamically group together saved searches that have matching substrings in their names. For example, in the Search app example above, a nested collection groups together all uncategorized searches with the string "admin" in their titles.
There are two ways that saved searches can be dynamically grouped together with matching substrings:
- As a collection of uncategorized substring-matching searches, which means that the collection only displays searches that haven't been manually added to another collection.
- As a collection of all substring-matching searches, which means that the collection displays all searches with the matching substring whether or not they appear elsewhere in the navigation menu.
Note: In both cases, only saved searches and reports that are available to the app with which the navigation menu is associated are displayed.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.
Comments
Per Robp, this document states that this can be done but doesn't direct the reader to the instructions and examples on how to do it. It would be a good idea to provide a link to that section of the doc.
-wolverine
found how to manually construct navigation here:
http://www.splunk.com/base/Documentation/4.1.3/Developer/Step6BuildNavigation
How does one "manually construct collections that group lists together by function" as listed above?
This really look exactly what I need to do. But how do I do it? Especially if I don't have my own APP, I am not developing my own app. I just need to customize the search app better.