Splunk Enterprise Security

How do I edit the time frame/window for a key indicator?

llee_splunk
Splunk Employee
Splunk Employee

How do I edit the time frame/window for a default key indicator (e.g. VULNS PER SYSTEM found in the Vulnerability Center)?

0 Karma
1 Solution

llee_splunk
Splunk Employee
Splunk Employee

The time frame/window is embedded within the search string that populates the key indicator. (e.g. earliest=-30d@d latest=+0s).  You can edit the searches for the key indicators by going to Configure > Content Management, select Type: Key Indicator, and click on the indicator(s) that you would like to modify.

Also see: http://docs.splunk.com/Documentation/ES/latest/Admin/Createkeyindicatorsearches#Edit_a_key_indicator...

View solution in original post

0 Karma

llee_splunk
Splunk Employee
Splunk Employee

The time frame/window is embedded within the search string that populates the key indicator. (e.g. earliest=-30d@d latest=+0s).  You can edit the searches for the key indicators by going to Configure > Content Management, select Type: Key Indicator, and click on the indicator(s) that you would like to modify.

Also see: http://docs.splunk.com/Documentation/ES/latest/Admin/Createkeyindicatorsearches#Edit_a_key_indicator...

0 Karma

neerajs_81
Builder

It looks like in recent versions of ES , there is no way to edit time range for Key indicator search.  Its not even defined in the query so not sure where is ES picking the default 24 hour window. 

Below is a sample key indicator search provided by ES for Access Notables.  How can i add the time range earliest=-2d latest=now() to the below query ?

| `es_notable_events` | search security_domain=access | stats sum(count) as count by timeDiff_type | transpose | sort 1 + column | rename "row 1" as current_count,"row 2" as historical_count | `get_delta` | table current_count,historical_count,delta

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...