topic Splunk Enterprise Security: How can I change the sort order of the incident review page? in Splunk Enterprise Security

Splunk Enterprise Security: How can I change the sort order of the incident review page?

leonphelps_s — Fri, 17 Feb 2017 15:08:34 GMT

How can I change the sort order of the incident review page within Splunk Enterprise Security? The default appears to be _time, but we'd like to do something urgency and then time or custom field and then time.

Re: Splunk Enterprise Security: How can I change the sort order of the incident review page?

AnthonyTibaldi — Fri, 17 Feb 2017 19:47:35 GMT

I don't think the sort change is possible using the standard "Incident Review" Dashboard

You could make a search that displays what you are looking for a separate dashboard or you could add a dropdown to the "Incident Review" dropdown that would only show open critical incidents or something of that nature.

Here is a link that would help.

http://docs.splunk.com/Documentation/ES/4.5.1/User/ManageSearches#Add_a_link_to_the_ES_menu

Re: Splunk Enterprise Security: How can I change the sort order of the incident review page?

martin_mueller — Mon, 20 Feb 2017 10:47:59 GMT

Click the table header to sort by that column.

Re: Splunk Enterprise Security: How can I change the sort order of the incident review page?

leonphelps_s — Mon, 20 Feb 2017 15:45:44 GMT

Thanks Anthony. I've used that link before to show unassigned or change the default time window, but it does not support the level of sort/grouping I'm asking for. Thanks again.

Re: Splunk Enterprise Security: How can I change the sort order of the incident review page?

leonphelps_s — Mon, 20 Feb 2017 15:57:11 GMT

Thanks Martin, you were part of the group that was discussing this with me in Slack. I'll have to do some testing but when I first checked it didn't seem to support sorting.. and then sub sorting.. because I want it to be reverse time sorted after being sorted by severity.

Re: Splunk Enterprise Security: How can I change the sort order of the incident review page?

aaraneta_splunk — Tue, 29 Sep 2020 13:42:30 GMT

@leonphelps_s - Were you able to find a solution to your answer? Did martin_mueller help generate that answer at all? If yes, please don't forget to post an additional comment within this thread or post a new answer if you were able to come up with a brand new solution. Then resolve your post by clicking "Accept" so others can find it. If you need additional help, please leave a comment with more feedback. Thanks!

Re: Splunk Enterprise Security: How can I change the sort order of the incident review page?

leonphelps_s — Thu, 20 Apr 2017 19:08:51 GMT

Martin was helpful in general as always but did not answer my question. I was able to do this by editing the incident_review.js which is obviously an unsupported modification.

Re: Splunk Enterprise Security: How can I change the sort order of the incident review page?

mikeyclarky — Tue, 23 Jan 2024 16:21:23 GMT

Super old topic, but shocking that it seems Splunk hasn't brought this functionality into the product. Would you be open to sharing the modifications you made to incident_review.js?

Thank you