Splunk Enterprise Security

How do I edit the time frame/window for a key indicator?

llee_splunk
Splunk Employee
Splunk Employee

How do I edit the time frame/window for a default key indicator (e.g. VULNS PER SYSTEM found in the Vulnerability Center)?

0 Karma
1 Solution

llee_splunk
Splunk Employee
Splunk Employee

The time frame/window is embedded within the search string that populates the key indicator. (e.g. earliest=-30d@d latest=+0s).  You can edit the searches for the key indicators by going to Configure > Content Management, select Type: Key Indicator, and click on the indicator(s) that you would like to modify.

Also see: http://docs.splunk.com/Documentation/ES/latest/Admin/Createkeyindicatorsearches#Edit_a_key_indicator...

View solution in original post

0 Karma

llee_splunk
Splunk Employee
Splunk Employee

The time frame/window is embedded within the search string that populates the key indicator. (e.g. earliest=-30d@d latest=+0s).  You can edit the searches for the key indicators by going to Configure > Content Management, select Type: Key Indicator, and click on the indicator(s) that you would like to modify.

Also see: http://docs.splunk.com/Documentation/ES/latest/Admin/Createkeyindicatorsearches#Edit_a_key_indicator...

0 Karma

neerajs_81
Builder

It looks like in recent versions of ES , there is no way to edit time range for Key indicator search.  Its not even defined in the query so not sure where is ES picking the default 24 hour window. 

Below is a sample key indicator search provided by ES for Access Notables.  How can i add the time range earliest=-2d latest=now() to the below query ?

| `es_notable_events` | search security_domain=access | stats sum(count) as count by timeDiff_type | transpose | sort 1 + column | rename "row 1" as current_count,"row 2" as historical_count | `get_delta` | table current_count,historical_count,delta

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...