Adding key indicator search to custom dashboard in Splunk Enterprise Security

[ThuLe]

Hello,

I'm trying to add new/existing key indicator searches to my dashboard in ES, but the edit toolbar does not have the "Add Key Indicator" button.

My custom dashboard:

My custom dashboard

Default dashboard with Key Indicators:

Default dashboard with Key Indicator

I also tried to clone the default "Email Activity" dashboard (which has existing key indicators in it), but the clone dashboard cannot be loaded.

What should I do?

If this is a bug, which log files do I need to check?

Thank you. 

[meetmshah]

Hello @ThuLe,

There should be input available in the dropdown menu - 

Can you please confirm if this is something you are looking for? Please accept the solution and hit Karma, if this helps!

[meetmshah]

Hello, Just checking through if the issue was resolved or you have any further questions?