Hi
Is there a way to show only critical, high, medium in incident review by default?
Not by default, but you could change the link to Incident Review to a filtered version of it by using these steps:
http://docs.splunk.com/Documentation/ES/4.2.0/User/ManageSearches#Add_a_link_to_the_ES_menu
(the steps apply for any ES installation though these docs are for a cloud-only version).
Not by default, but you could change the link to Incident Review to a filtered version of it by using these steps:
http://docs.splunk.com/Documentation/ES/4.2.0/User/ManageSearches#Add_a_link_to_the_ES_menu
(the steps apply for any ES installation though these docs are for a cloud-only version).
Thanks!how to add default=true to this one to make this as default page for ES
@kiran331 I just tested moving "default=true" from ess_home to the incident_review view, and that worked for me. Does that work for you?
Can i use default = true with in the href tag
Sadly I couldn't get that to work, even when it referenced an app context.