Splunk Enterprise Security

Adding key indicator search to custom dashboard in Splunk Enterprise Security

ThuLe
Explorer

Hello,

I'm trying to add new/existing key indicator searches to my dashboard in ES, but the edit toolbar does not have the "Add Key Indicator" button.

My custom dashboard:

My custom dashboardMy custom dashboard

Default dashboard with Key Indicators:

Default dashboard with Key IndicatorDefault dashboard with Key Indicator

I also tried to clone the default "Email Activity" dashboard (which has existing key indicators in it), but the clone dashboard cannot be loaded.

image.pngimage.png

What should I do?

If this is a bug, which log files do I need to check?

 

Thank you. 

Labels (3)
0 Karma

LeeKeener2nd
New Member

This is a little late, but I was interested in doing the same thing as OP. Looking at ES dashabord source it looks like key indicators visualization is custom. Make me question using it in my own dashboard. Is that a good idea?

LeeKeener2nd_0-1722389620025.png

 

0 Karma

meetmshah
Builder

Hello @ThuLe,

There should be input available in the dropdown menu - 

meetmshah_0-1696077616676.png

 

Can you please confirm if this is something you are looking for? Please accept the solution and hit Karma, if this helps!

0 Karma

meetmshah
Builder

Hello, Just checking through if the issue was resolved or you have any further questions?

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...