Splunk Enterprise Security

How to add "open in search button" for notable events?

CSmoke
Path Finder

When viewing notable events on the Incident Review Dashboard, there is a link named Correlation Search.
The link opens the standard screen to edit the search.

Would it be possible to add the magnifying glass icon next to this link so that users can open the search without cutting and pasting the query?

0 Karma

Azerty728
Path Finder

Hello,

You can also create a Workflow Action, which can open the search. The Workflow action will appear at the end of the notable line in Incident Review, under "Actions" column.

My 2 cents

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @CSmoke,

As far as you are using Splunk ES dashboard it is not recommended to make any changes in the dashboard. But if you want to do it you will require to change XML dashboard code to add that magnifying glass icon and also require to add JS code to act on-click event on the icon and collect the search and open new tab with search.

CSmoke
Path Finder

My post was more of a feature request than a question. It is something I would like Splunk to add.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

If you are having Splunk Enterprise licence than you can at least make a feature request through Splunk support team.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...