Add navigation to a Splunk app

Add navigation to your app by modifying the app bar to specify how users will access the dashboards, reports, data models, and alerts in your app. Here's an example of an app bar for a Splunk app:

[Default app bar]

This navigation structure is defined in an XML file, default.xml, which is located in $SPLUNK_HOME/etc/apps/your_app_name/default/data/ui/nav/, which is created automatically when you create an app.

This is the XML structure for the default app bar:

<nav search_view="search">
  <view name="search" default='true' />
  <view name="datasets" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />

Modify the app bar

Edit the default.xml file to modify the app bar. You can edit the source file directly using your own text editor, or use the Splunk software's Source Editor (in Splunk Web, go to Settings > User Interface, click Navigation menus, then click default for your app).

To view your changes, restart Splunk Web or refresh the page by opening the http://<localhost:port>/debug/refresh URL in your web browser, click Refresh, then reload the page in the browser.

You can modify the app bar by setting or adding the following features:

Default search target and home page

To enable other apps to run a search query in your app, specify the target dashboard using the search_view tag. By default, "search" is the target dashboard.

To change the default home page for your app, use the default="true" property. When no view is marked as default, the first one listed in default.xml is used.

<nav search_view="search" color="#0072C6">

    <!-- Set "myhomedashboard" as the default page -->
    <view name="myhomedashboard" default="true" />

Dashboard links

Add links to dashboards on the app bar using the view tag. Add lists of links using the collection tag. Two levels of nesting are supported.

    <!-- Use the view tag to create a dashboard link -->
    <view name="dashboard1" />

    <!-- Use the collection tag to create a list of items -->
    <collection label="Menu name">

        <!-- Add items to the list -->
        <view name="dashboard2" />
        <view name="dashboard3" />

        <!-- Add a nested list with items -->
        <collection label="Submenu name">
            <view name="dashboard4" />
            <view name="dashboard5" />


Report links

Add links to reports on the app bar using the saved="report_name" tag:

    <!-- Use the saved tag to create a report link -->
    <saved name="report1" />

Specify the dashboard in which to display a report by adding the view="dashboard_name" property. Splunk Enterprise checks for a "view" property attached to the the report in the savedsearches.conf configuration file. If a value is not specified, the report is launched in the Search app's "timeline" view.

    <!-- Display the report in the "mycharts" dashboard -->
    <saved name="report1" view="mycharts" />

External links

Add external links to the app bar using the a tag:

    <!-- This is an external link -->
    <a href="">Splunk Developer Portal</a>

Dynamic lists

Generate dynamic lists of all dashboards or all reports that are available to the app using the source="all" property:

    <!-- Dynamically list all available dashboards-->
    <collection label="All dashboards">
        <view source="all" />

    <!-- Dynamically list all available reports-->
    <collection label="All reports">
        <saved source="all" />

Generate a dynamic list of dashboards or reports that contain a substring by using the match="substring" property. This example displays a menu of all dashboards and a menu of all reports that include the word "error" in their name:

    <!-- Dynamically list all dashboards with the word "error"-->
    <collection label="Dashboards (errors)">
        <view source="all" match="error"/>

    <!-- Dynamically list all reports with the word "error"-->
    <collection label="Reports (errors)">
        <saved source="all" match="error"/>

Classified dashboards and reports are those that are explicitly referred to in default.xml using the name="name" property. All other dashboards and reports are unclassified.

Generate a dynamic list of all unclassified dashboards or reports using the source="unclassified" property. This example displays all dashboards except "dashboard1" and all reports except "report1":

    <view name="dashboard1" />
    <saved name="report1" />

    <!-- Dynamically list all unclassified dashboards -->
    <collection label="Others">
        <view source="unclassified" />

    <!-- Dynamically list all unclassified reports -->
    <collection label="Others">
        <saved source="unclassified" />

Saved searches list

By default, Splunk Enterprise limits the number of saved searches it lists in the Navigation drop-down menu of an app. The default limit is 500. If you expect your app to access more than 500 saved searches and you are using Splunk Enterprise 6.5.4 or later, consider adding an appNavReportsLimit attribute in the web.conf file to increase the number of saved searches the app lists in the Navigation drop-down menu. If you set the value of appNavReportsLimit higher than 500, you may incur a decrease in browser performance.

See the web.conf documentation for details and further context.

appNavReportsLimit = <integer>
* Maximum number of reports to fetch to populate the navigation drop-down menu of an app.
* An app must be configured to list reports in its navigation XML configuration before it can list any reports.
* Set to -1 to display all the available reports in the navigation menu.
* NOTE: Setting to either -1 or a value that is higher than the default might result in decreased browser performance due to listing large numbers of available reports in the drop-down menu.
* Defaults to 500.