Navigation Menu xml Match Help

Question

In the Default Search Nav Menu I am trying to match all of my Active Directory reports so they are Nested in "AD Reports". All of the reports start with "AD ". The issue i'm running into is that other reports that have "AD " are matching such as "Dead Hosts".

<collection label="AD Reports">
  <saved source="unclassified" match="AD " />
</collection>

I searched for anything about xml and match but could not find any rules or ways to use regex. Any ideas about how to specify a match?

Similar to a question asked by Glenn, what characters are we allowed to use to specify the match?:

http://answers.splunk.com/questions/4288/is-it-possible-to-match-views-in-app-menu-using-wildcards-or-multiple-match-stri

Accepted Answer

1	The match is a simple case-insensitive substring match, so unfortunately no regex or anything else special is available here. link answered 17 Mar '11, 20:24 gkanapathy ♦ 32.4k●4●8●27 accept rate: 41%

Answer 2

0

Until regex matching is brought in, the next-best approach would probably be changing your naming convention, like starting all reports with _ and then matching on "_AD ".

not the most elegant solution, but might work.

link

answered 15 May, 01:58

brettcave
353●1●9
accept rate: 29%

and on playing with this, when matching, it matches on the name of a view, not the display name, so you could rename all your views to __ad__foo and leave the display name as "AD Foo"

(15 May, 02:15) brettcave

Answer 3

2	This sounds like a mod request? ( to use regex) link answered 19 Jul '11, 07:47 Starlette 463●2●3●27 accept rate: 9% +1000 on this! (15 May, 01:55) brettcave

Navigation Menu xml Match Help

Follow this question

Splunk Resources

Related questions