All Apps and Add-ons

How can I change the Cisco Security Suite Overview dashboard search with a source IP input?

Explorer

Hello Splunkers,

I would like to change search of Cisco Security Suite dashboard with source IP input.

I tried to add an input and define token as src_ip, but when I fill out the src_ip, the dashboard does ot change.

alt text

Please kindly advise how can I change search with a source IP input?

Thanks

0 Karma
1 Solution

Path Finder

You need to modify each of the panels' searches to also search based on that source ip input. Use the $token$ you created for your text input.

View solution in original post

Path Finder

You need to modify each of the panels' searches to also search based on that source ip input. Use the $token$ you created for your text input.

View solution in original post

Explorer

Vasildavid, Thanks for you advice.
All panels in Cisco Security Suite - OVerview not has . So I tried to add in the XML. The result is I see only the src_ip"10.231.0.*" look like replace default search.

How can I add without replace the default search.

Thanks

0 Karma

Path Finder

It looks as though those panels are run from reports. You could clone the panels you are interested in to inline searches and change the search string to something like this (assuming you named your token ip_input_filter):

... src_ip="$ip_input_filter$" ...
0 Karma

Explorer

It's work. Thanks you so much, Vasildavid.

0 Karma