We created Dashboard in Splunk enterprise security where we can see the commands status and risk score for those commands.
Do we have option in Spunk enterprise security where we can see the output of that particular command, Like I click the status of one command to see the events and it will tell me the status of Command output
No, Actually I need to check the status of output of that particular command , Like other application if we click command rating we can see the complete details like output of command , source etc.
Here i click command i can see the events only
A bit more clarity on exactly what you are looking for would indeed help.
Is the data you are after in Splunk already? If so: write a search that finds it and then tokenize it and configure it as a custom drilldown for your dashboard.
Yes already data in splunk which monitor the seesion ID, Commands running on Unix server, In other application PSRS I can see the output of particular command when i select the command But in Splunk When i click the Commands which are monitored in Splunk and displaying in Dashboard I am not able to see the output of command
If you want to see the output of the command in Splunk by clicking on it, you need two things:
In dashboard I can see the commands are running for particular session are displaying.
Session ID , Commands run on unix server that are monitored in Spunk , Session start time , Start end time these are columns are showing in Dashboard from last 24 hours data.
In other application PSRS I can see the output of command when i click, BUt in splunk i am not able to see this option
Let me know if you understand my question