Splunk Enterprise Security

In the Splunk Enterprise Security Incident Review Dashboard, is it possible to change the default status label?

New Member

Is it possible to change default status value from "All" to New & "In Progress" via GUI in the Incident Review dashboard?

Or do we need to edit incident_review.js script : form.status_form=1&form.status_form=2

Here I want to filter only "New" and "In Progress" by default

0 Karma

Splunk Employee
Splunk Employee

Follow these instructions and it will work for you! http://docs.splunk.com/Documentation/ES/5.1.1/Admin/Customizemenubar#Add_a_link_to_a_filtered_view_o...
You'll have to update the navigation to point to the new view of incident review after you construct it, but this is the best solution for your use case.


You cannot modify the Incident Review link itself but you can create a new collection and views (or just a view if you prefer) by editing the XML of the navigation UI. Adding a collection will create a new drop down navigation menu that will allow you to select your customized search(es) against notable events.

Click: Settings > User Interface > Navigation menus > default (app: SplunkEnterpriseSecuritySuite)

Or simply browse to: {your splunk addr}/en-US/manager/SplunkEnterpriseSecuritySuite/data/ui/nav/
Then click the Nav name: default

Edit the XML by adding the collection tags and links between other view tags.

My collection XML code looks like this:

<collection label="Alarm Queue">
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-3d%40d&amp;latest=now&amp;form.status_form=1&amp;form.status_form=2&amp;form.owner_form=unassigned&amp;form.security_domain_form=*&amp;form.srch=&amp;form.selected_urgency=critical&amp;form.selected_urgency=high&amp;form.selected_urgency=medium&amp;form.selected_urgency=low&amp;form.selected_urgency=informational'>Default - Alarm Queue</a>
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-7d%40d&amp;latest=now&amp;form.status_form=0&amp;form.status_form=2&amp;form.status_form=3&amp;form.status_form=4&amp;form.owner_form=*&amp;form.security_domain_form=*&amp;form.srch=&amp;form.selected_urgency=critical&amp;form.selected_urgency=high&amp;form.selected_urgency=medium&amp;form.selected_urgency=low&amp;form.selected_urgency=informational'> Review - Not Closed</a>

I have the code shown above between the following code in the XML:

<view name="ess_security_posture"></view>
 [the code above]
<view name="incident_review"></view>
[rest of the XML for your navigation ui]

This results in the following navigation UI:
alt text

The "Default - Alarm Queue" looks like this:
alt text

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!