topic Re: How to configure time picker for dashboard in Enterprise Security? in Getting Data In

How to configure time picker for dashboard in Enterprise Security?

splunky_diamond — Tue, 14 May 2024 05:59:06 GMT

Hello Splunkers!

In the Security Posture by default there are no filters that would allow us to adjust the time, meaning, we see the summary about notable events over the last 24 hours. I want to change that, I have added a time picker that I would like to bind to one dashboard in the security posture - "Key indicators" so that I can see for example the summary of notable events over the last 12 hours or 7 days. Can someone please explain what needs to be done on time picker or dashboard in order to achieve this, or maybe is there an easier way to do this?

Thanks for taking your time reading and replying to my post ❤️

Re: How to configure time picker for dashboard in Enterprise Security?

Temuulen0303 — Tue, 14 May 2024 07:33:45 GMT

yes you are doing it right.
After adding time picker you can click on this icon:

and
1) select edit on your query
2) Go to "Time Range"
3) Click on Input and select your Time picker token

Re: How to configure time picker for dashboard in Enterprise Security?

splunky_diamond — Tue, 14 May 2024 10:55:58 GMT

Hello @Temuulen0303 ,

Thanks for taking your time replying to my post!

I checked, it is only applicable to search "notable event by urgency", as for the saved searches, there is no option to choose the time range:

Also, for some reason when I linked the time range with "notable events by urgency" when I select the custom time, it does not apply for some reason... I checked in the source code of that search, the query for the earliest and latest time, it does take it from my time picker that I added.

Re: How to configure time picker for dashboard in Enterprise Security?

splunky_diamond — Fri, 17 May 2024 04:50:15 GMT

Update: it actually did work! I just opened the dashboard in a search and the time-picker is indeed applied.