Dashboards & Visualizations

Looking to create a dashboard that will show lockout data for a specific user ID via text input?

Bigmikes2
New Member

We have a basic search needed but need to be able to input specific users into a simple dashboard format.

EventCode=4740 user=X

Just looking to show over last 24hours

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

May be something like this

<form>
  <label>Account Lockouts</label>
  <fieldset submitButton="false">
    <input type="text" token="user" searchWhenChanged="true">
      <label>User</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>EventCode=4740 user=$user$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

somesoni2
Revered Legend

May be something like this

<form>
  <label>Account Lockouts</label>
  <fieldset submitButton="false">
    <input type="text" token="user" searchWhenChanged="true">
      <label>User</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>EventCode=4740 user=$user$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

Bigmikes2
New Member

Thx, that was a good base to start with.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...