topic Re: Splunk Enterprise security Filters in Getting Data In

Splunk Enterprise security Filters

Nawab — Wed, 14 Feb 2024 06:57:52 GMT

I have installed the latest splunk with Splunk enterprise security on it.

I have worked with enterprise security before, and there were some filters available to filter incidents, now in this version 7.3.0 there are no filters,

Is there anything wrong I am doing?

Re: Splunk Enterprise security Filters

Nawab — Wed, 14 Feb 2024 06:59:12 GMT

These are options i want

Re: Splunk Enterprise security Filters

gcusello — Wed, 14 Feb 2024 07:18:20 GMT

Hi @Nawab,

which dashboard are you speaking of?

in the Incident Review dashboard, the filters are the ones you shared.

Ciao.

Giuseppe

Re: Splunk Enterprise security Filters

Nawab — Wed, 14 Feb 2024 07:19:57 GMT

yes the dashboard of enterprise security and its filters

Re: Splunk Enterprise security Filters

gcusello — Wed, 14 Feb 2024 07:25:20 GMT

Hi @Nawab,

in Enterprise Security there are many dashboards:

the filters you shared seem to be the ones in the Incident Review dashboard.

Did you tried to click two times the Hide Filters button?

Ciao.

Giuseppe

Re: Splunk Enterprise security Filters

Nawab — Wed, 14 Feb 2024 07:39:38 GMT

Yes, i am talking about the incident review dashboard of version 7.3.0, and I tried clicking it multiple times, still same. Also opened a case with splunk support

Re: Splunk Enterprise security Filters

gcusello — Wed, 14 Feb 2024 07:43:21 GMT

Hi @Nawab,

I have only 7.2 version, but this issue is really strange because I don't think that Splunk remoived filters from this dashboard.

I suppose that the Splunk Support should help you.

Ciao.

Giuseppe

Re: Splunk Enterprise security Filters

bharathkumarnec — Thu, 29 Feb 2024 12:46:13 GMT

@Nawab , Please try below : https://docs.splunk.com/Documentation/ES/7.3.0/Admin/CustomizeIR

In the Splunk Enterprise Security app, select Configure.

Select General and then select General Settings.

Go to Enhanced Incident Review workflow panel.

Select Turn off.

Re: Splunk Enterprise security Filters

Nawab — Thu, 29 Feb 2024 12:52:33 GMT

this works fro me

Re: Splunk Enterprise security Filters

gcusello — Thu, 29 Feb 2024 13:17:54 GMT

Hi @Nawab ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Splunk Enterprise security Filters

splunkreal — Sat, 02 Mar 2024 14:19:38 GMT

Hello, thanks for solution, so "enhanced" view removes those useful filters, strange...

Re: Splunk Enterprise security Filters

bharathkumarnec — Sat, 02 Mar 2024 17:43:49 GMT

@splunkreal , the filters are still there but at each individual column level, you can use those to apply filters.