All Apps and Add-ons

How can I change the Cisco Security Suite Overview dashboard search with a source IP input?

seksit
Explorer

Hello Splunkers,

I would like to change search of Cisco Security Suite dashboard with source IP input.

I tried to add an input and define token as src_ip, but when I fill out the src_ip, the dashboard does ot change.

alt text

Please kindly advise how can I change search with a source IP input?

Thanks

0 Karma
1 Solution

vasildavid
Path Finder

You need to modify each of the panels' searches to also search based on that source ip input. Use the $token$ you created for your text input.

View solution in original post

vasildavid
Path Finder

You need to modify each of the panels' searches to also search based on that source ip input. Use the $token$ you created for your text input.

View solution in original post

seksit
Explorer

Vasildavid, Thanks for you advice.
All panels in Cisco Security Suite - OVerview not has . So I tried to add in the XML. The result is I see only the src_ip"10.231.0.*" look like replace default search.

How can I add without replace the default search.

Thanks

0 Karma

vasildavid
Path Finder

It looks as though those panels are run from reports. You could clone the panels you are interested in to inline searches and change the search string to something like this (assuming you named your token ip_input_filter):

... src_ip="$ip_input_filter$" ...
0 Karma

seksit
Explorer

It's work. Thanks you so much, Vasildavid.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!