Splunk dashboard customization

[sankardevarajan]

I have enterprise network and we have Splunk enterprise license. 

Question: while troubleshooting source type or host if checking, it needs to show past history of particular user or source in the dashboard.

Past history like how many alerts triggered the same user, those alert details if click the link it must be show past troubleshooting history.

[gcusello]

Hi @sankardevarajan,

could you better describe your question, because it isn't so clear:

are you speaking of Splunk Enterprise or Splunk Enterprise Security?

if you want to know triggered alerts you could use something like this:

index=_audit action=alert_fired ss_app=* 
| eval ttl=expiration-now() 
| search ttl>0 
| convert ctime(trigger_time) 
| table trigger_time ss_name severity 
| rename 
   trigger_time AS "Alert Time" 
   ss_name AS "Alert Name" 
   severity AS "Severity"

but it depends on the retention of your _audit index.

Ciao.

Giuseppe