How can I change the Cisco Security Suite Overview dashboard search with a source IP input?

[seksit]

Hello Splunkers,

I would like to change search of Cisco Security Suite dashboard with source IP input.

I tried to add an input and define token as src_ip, but when I fill out the src_ip, the dashboard does ot change.

Please kindly advise how can I change search with a source IP input?

Thanks

[vasildavid · Accepted solution]

You need to modify each of the panels' searches to also search based on that source ip input. Use the $token$ you created for your text input.

[seksit]

Vasildavid, Thanks for you advice.
All panels in Cisco Security Suite - OVerview not has . So I tried to add in the XML. The result is I see only the src_ip"10.231.0.*" look like replace default search.

How can I add without replace the default search.

Thanks

[vasildavid]

It looks as though those panels are run from reports. You could clone the panels you are interested in to inline searches and change the search string to something like this (assuming you named your token ip_input_filter):

... src_ip="$ip_input_filter$" ...

[seksit]

It's work. Thanks you so much, Vasildavid.