Is it possible to change default status value from "All" to New & "In Progress" via GUI in the Incident Review dashboard?
Or do we need to edit incident_review.js script : form.status_form=1&form.status_form=2
Here I want to filter only "New" and "In Progress" by default
Follow these instructions and it will work for you! http://docs.splunk.com/Documentation/ES/5.1.1/Admin/Customizemenubar#Add_a_link_to_a_filtered_view_o...
You'll have to update the navigation to point to the new view of incident review after you construct it, but this is the best solution for your use case.
You cannot modify the Incident Review link itself but you can create a new collection and views (or just a view if you prefer) by editing the XML of the navigation UI. Adding a collection will create a new drop down navigation menu that will allow you to select your customized search(es) against notable events.
Click: Settings > User Interface > Navigation menus > default (app: SplunkEnterpriseSecuritySuite)
Or simply browse to: {your splunk addr}/en-US/manager/SplunkEnterpriseSecuritySuite/data/ui/nav/
Then click the Nav name: default
Edit the XML by adding the collection tags and links between other view tags.
My collection XML code looks like this:
<collection label="Alarm Queue">
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-3d%40d&latest=now&form.status_form=1&form.status_form=2&form.owner_form=unassigned&form.security_domain_form=*&form.srch=&form.selected_urgency=critical&form.selected_urgency=high&form.selected_urgency=medium&form.selected_urgency=low&form.selected_urgency=informational'>Default - Alarm Queue</a>
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-7d%40d&latest=now&form.status_form=0&form.status_form=2&form.status_form=3&form.status_form=4&form.owner_form=*&form.security_domain_form=*&form.srch=&form.selected_urgency=critical&form.selected_urgency=high&form.selected_urgency=medium&form.selected_urgency=low&form.selected_urgency=informational'> Review - Not Closed</a>
</collection>
I have the code shown above between the following code in the XML:
<view name="ess_security_posture"></view>
[the code above]
<view name="incident_review"></view>
[rest of the XML for your navigation ui]
This results in the following navigation UI:
The "Default - Alarm Queue" looks like this: