How to add "open in search button" for notable events?

[CSmoke]

When viewing notable events on the Incident Review Dashboard, there is a link named Correlation Search.
The link opens the standard screen to edit the search.

Would it be possible to add the magnifying glass icon next to this link so that users can open the search without cutting and pasting the query?

[Azerty728]

Hello,

You can also create a Workflow Action, which can open the search. The Workflow action will appear at the end of the notable line in Incident Review, under "Actions" column.

My 2 cents

[VatsalJagani]

Hi @CSmoke,

As far as you are using Splunk ES dashboard it is not recommended to make any changes in the dashboard. But if you want to do it you will require to change XML dashboard code to add that magnifying glass icon and also require to add JS code to act on-click event on the icon and collect the search and open new tab with search.

[CSmoke]

My post was more of a feature request than a question. It is something I would like Splunk to add.

[VatsalJagani]

If you are having Splunk Enterprise licence than you can at least make a feature request through Splunk support team.