- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Home page should be alert page
cyber_Maddy
Engager
10-12-2021
02:42 AM
The default page needs to be changed, after login to Splunk I should be directed to all the triggered alert page.
Eg: below are the triggered alert, After login I should be able to see the alert which is triggered with time seviarity and other common information and after analyzing I should be able to close the triggered alert. Can any one please guide me on this ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Stefanie
Builder
10-12-2021
08:48 AM
You can use a search like this to create a dashboard for your homepage.
index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity"
