Splunk Enterprise Security

Search Help: Search Boxes on Dashboard

adalbor
Builder

Hey All,

I need some assistance with completing some search parameters.

I created a search to correlate emails going in and out of proofpoint according to the message_session_id using transaction and displaying in a table format. Proofpoint generates multiple events for a single message which requires stitching it all together.

I would like to turn this into a dashboard with two search boxes that would allow me to specify the search parameters for the sender and recipient while still maintaining the correlation using transaction.

Here is my current search:

index=proofpoint
| transaction message_session_id
| table from to subject file_name rule action
| fillnull value=n/a

Would I achieve this using tokens? Or how would I go about this?

0 Karma

woodcock
Esteemed Legend

There are many examples in the Dashboard Examples app. Install it and it will have something almost exactly like what you need (except for the SPL, which you already have):
https://splunkbase.splunk.com/app/1603/

Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...