Splunk Enterprise Security
Highlighted

How do I edit the time frame/window for a key indicator?

Path Finder

How do I edit the time frame/window for a default key indicator (e.g. VULNS PER SYSTEM found in the Vulnerability Center)?

0 Karma
Highlighted

Re: How do I edit the time frame/window for a key indicator?

Path Finder

The time frame/window is embedded within the search string that populates the key indicator. (e.g. earliest=-30d@d latest=+0s).  You can edit the searches for the key indicators by going to Configure > Content Management, select Type: Key Indicator, and click on the indicator(s) that you would like to modify.

Also see: http://docs.splunk.com/Documentation/ES/latest/Admin/Createkeyindicatorsearches#Edit_a_key_indicator...

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.