Splunk Enterprise Security

How to add "open in search button" for notable events?

CSmoke
Path Finder

When viewing notable events on the Incident Review Dashboard, there is a link named Correlation Search.
The link opens the standard screen to edit the search.

Would it be possible to add the magnifying glass icon next to this link so that users can open the search without cutting and pasting the query?

0 Karma

Azerty728
Path Finder

Hello,

You can also create a Workflow Action, which can open the search. The Workflow action will appear at the end of the notable line in Incident Review, under "Actions" column.

My 2 cents

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @CSmoke,

As far as you are using Splunk ES dashboard it is not recommended to make any changes in the dashboard. But if you want to do it you will require to change XML dashboard code to add that magnifying glass icon and also require to add JS code to act on-click event on the icon and collect the search and open new tab with search.

CSmoke
Path Finder

My post was more of a feature request than a question. It is something I would like Splunk to add.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

If you are having Splunk Enterprise licence than you can at least make a feature request through Splunk support team.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...