Dashboards & Visualizations

Can dashboard provide results based on the search I provide separately?

hcheang
Path Finder

Hello,

I have a quick question regarding dashboard. I would like to know if the search queries I have provided on dashboard panels can be applied after I input some value such as a user name. What I mean is that based on the username I provide on search head or wherever, the panels will give results. In other words, theses panels will give different results based on the username. Basically, I want to create a dashboard which summarize user activity.

Search queries I'm using are:
%Windows failed logins (count and source)
Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) |stats count by user dst src|fields user src dest count|rename dst as System|sort -count

%Windows failed logins (times)
Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) | bucket _time span=1h | stats count by _time user

%Windows successful logins
EventCode=4624 Logon_Type=10 |stats count by _time host, user, src |sort –count

If all fails, my plan is to mimic the time picker to create user picker... am I going in right direction?

0 Karma
1 Solution

ramdaspr
Contributor

Yes, you will need to create input fields and tokenize them so that the dashboard queries can pickup those queries and populate the tables.
For example, you can create a textfield with a token txt_tok

<input type="text" token="txt_tok">
      <label>UserName</label>
    </input>

and use the token in a dashbaord panel search query

Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) |stats count by $txt_tok$ dst src|fields $txt_tok$ src dest count|rename dst as System|sort -count

View solution in original post

ramdaspr
Contributor

Yes, you will need to create input fields and tokenize them so that the dashboard queries can pickup those queries and populate the tables.
For example, you can create a textfield with a token txt_tok

<input type="text" token="txt_tok">
      <label>UserName</label>
    </input>

and use the token in a dashbaord panel search query

Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) |stats count by $txt_tok$ dst src|fields $txt_tok$ src dest count|rename dst as System|sort -count

View solution in original post

hcheang
Path Finder

works like magic! thanks!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!