Splunk dashboard customization

sankardevarajan — Thu, 25 Jan 2024 14:46:46 GMT

I have enterprise network and we have Splunk enterprise license.

Question: while troubleshooting source type or host if checking, it needs to show past history of particular user or source in the dashboard.

Past history like how many alerts triggered the same user, those alert details if click the link it must be show past troubleshooting history.

Re: Splunk dashboard customization

gcusello — Thu, 25 Jan 2024 16:00:53 GMT

could you better describe your question, because it isn't so clear:

are you speaking of Splunk Enterprise or Splunk Enterprise Security?

if you want to know triggered alerts you could use something like this:

but it depends on the retention of your _audit index.

Ciao.

Giuseppe