topic Re: Adding key indicator search to custom dashboard in Splunk Enterprise Security in Splunk Search

How to add a key indicator search to custom dashboard in Splunk Enterprise Security?

ThuLe — Tue, 12 Sep 2023 21:21:31 GMT

Hello,

I'm trying to add new/existing key indicator searches to my dashboard in ES, but the edit toolbar does not have the "Add Key Indicator" button.

My custom dashboard:

My custom dashboard

Default dashboard with Key Indicators:

Default dashboard with Key Indicator

I also tried to clone the default "Email Activity" dashboard (which has existing key indicators in it), but the clone dashboard cannot be loaded.

What should I do?

If this is a bug, which log files do I need to check?

Thank you.

Re: Adding key indicator search to custom dashboard in Splunk Enterprise Security

gcusello — Tue, 12 Sep 2023 10:33:18 GMT

Hi @ThuLe,

the process to add new Key Indicators is described in Enterprise Security Training.

Very quickly, if you want to use one of the already existing KI Searches you have to:

Click on Security Posture Dashboard,
Click on Edit
click on "+" button
choose the wanted Indicator
click on tick for saving

If you want to create your own KI the procedure is more long and it's difficoult to describe here, anyway, as everything in ES you can create it in [Configure > Content > Content Management > Key Indicators].

Ciao.

Giuseppe

Re: Adding key indicator search to custom dashboard in Splunk Enterprise Security

ThuLe — Tue, 12 Sep 2023 10:51:57 GMT

Hi @gcusello

Default dashboards such as Security Posture have the button "Add Key Indicator" but the custom dashboard does not have it.

security posturecustom dashboard

Thanks.

Re: Adding key indicator search to custom dashboard in Splunk Enterprise Security

gcusello — Tue, 12 Sep 2023 11:21:45 GMT

Hi @ThuLe,

it's possible to add Key Indicators only to the Security Posture Dashboard.

If you want to add a KI to a custom dashboard, you can use the search and add it to a panel as a normal search.

Key indicators are already configured panels, but at least they are panels!

Ciao.

Giuseppe