Splunk Enterprise Security

Enterprise Security: How to add swimlanes of custom sourcetypes to Identity Investigator dashboard?

joshuamcqueen
Path Finder

Hey Splunkers,

Our securty team really likes the Identity Investigator dashboard. Only things is -- it would be GREAT to add a few more swimlanes of custom sourcetypes (for example, our DNS, Proxy...etc).

I see you can edit, remove, rename the default sourcetypes, but is there anyway to add a new one?

Looked at the code underneath and everything seems pretty hard-coded. Is there a best-practices approach?

Thanks!

1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Yes, if you make a new saved search with the right arguments and matching the naming convention, it will work. To see some some examples, try

find . -name savedsearches.conf | xargs grep Swimlane\] | grep -v Installer | grep -v old

View solution in original post

LukeMurphey
Champion

If you are using ES 3.1 or later, then you can use the editor to make a new swimlane with whatever content you want. Go to "Configure" > "Custom Searches" > "New".

0 Karma

lakshman239
SplunkTrust
SplunkTrust

On ES 4.0+ , the same is now available as part of 'Configure->Content Management-> New '

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Yes, if you make a new saved search with the right arguments and matching the naming convention, it will work. To see some some examples, try

find . -name savedsearches.conf | xargs grep Swimlane\] | grep -v Installer | grep -v old

joshuamcqueen
Path Finder

VERY Helpful. Would have never figured this out on my own.
Thank you for showing me this example. I'll work on implementing this soon -- provide more information, questions as they come up.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...