Splunk Enterprise Security

Search Help: Search Boxes on Dashboard

adalbor
Builder

Hey All,

I need some assistance with completing some search parameters.

I created a search to correlate emails going in and out of proofpoint according to the message_session_id using transaction and displaying in a table format. Proofpoint generates multiple events for a single message which requires stitching it all together.

I would like to turn this into a dashboard with two search boxes that would allow me to specify the search parameters for the sender and recipient while still maintaining the correlation using transaction.

Here is my current search:

index=proofpoint
| transaction message_session_id
| table from to subject file_name rule action
| fillnull value=n/a

Would I achieve this using tokens? Or how would I go about this?

0 Karma

woodcock
Esteemed Legend

There are many examples in the Dashboard Examples app. Install it and it will have something almost exactly like what you need (except for the SPL, which you already have):
https://splunkbase.splunk.com/app/1603/

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...