All Apps and Add-ons

How can I change the Cisco Security Suite Overview dashboard search with a source IP input?

seksit
Explorer

Hello Splunkers,

I would like to change search of Cisco Security Suite dashboard with source IP input.

I tried to add an input and define token as src_ip, but when I fill out the src_ip, the dashboard does ot change.

alt text

Please kindly advise how can I change search with a source IP input?

Thanks

0 Karma
1 Solution

vasildavid
Path Finder

You need to modify each of the panels' searches to also search based on that source ip input. Use the $token$ you created for your text input.

View solution in original post

vasildavid
Path Finder

You need to modify each of the panels' searches to also search based on that source ip input. Use the $token$ you created for your text input.

seksit
Explorer

Vasildavid, Thanks for you advice.
All panels in Cisco Security Suite - OVerview not has . So I tried to add in the XML. The result is I see only the src_ip"10.231.0.*" look like replace default search.

How can I add without replace the default search.

Thanks

0 Karma

vasildavid
Path Finder

It looks as though those panels are run from reports. You could clone the panels you are interested in to inline searches and change the search string to something like this (assuming you named your token ip_input_filter):

... src_ip="$ip_input_filter$" ...
0 Karma

seksit
Explorer

It's work. Thanks you so much, Vasildavid.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...