Hello Splunkers!
In the Security Posture by default there are no filters that would allow us to adjust the time, meaning, we see the summary about notable events over the last 24 hours. I want to change that, I have added a time picker that I would like to bind to one dashboard in the security posture - "Key indicators" so that I can see for example the summary of notable events over the last 12 hours or 7 days. Can someone please explain what needs to be done on time picker or dashboard in order to achieve this, or maybe is there an easier way to do this?
Thanks for taking your time reading and replying to my post ❤️
yes you are doing it right.
After adding time picker you can click on this icon:
and
1) select edit on your query
2) Go to "Time Range"
3) Click on Input and select your Time picker token
yes you are doing it right.
After adding time picker you can click on this icon:
and
1) select edit on your query
2) Go to "Time Range"
3) Click on Input and select your Time picker token
Hello @Temuulen0303 ,
Thanks for taking your time replying to my post!
I checked, it is only applicable to search "notable event by urgency", as for the saved searches, there is no option to choose the time range:
Also, for some reason when I linked the time range with "notable events by urgency" when I select the custom time, it does not apply for some reason... I checked in the source code of that search, the query for the earliest and latest time, it does take it from my time picker that I added.
