Splunk Enterprise Security

Splunk Enterprise Security: How to update the Incident Review Audit Dashboard to include a timepicker?

AndySplunks
Communicator

Has anyone ever tried updating the Incident Review Audit Dashboard in Splunk ES to include a timepicker?

I can't seem to get any of the searches in the panels to use the timepicker.

0 Karma
1 Solution

AndySplunks
Communicator

Here are some searches that cover my use cases:

This search will show review activity over time by user.
| `incident_review| where _time>=relative_time(now(), "$timeframe.earliest$") AND _time<=relative_time(now(), "$timeframe.latest$") | timechart useother=useother` count by reviewer_realname span=1d

This search is for notable events that are opened over time by their urgency.
| `notable` | search NOT suppression=* | timechart count by urgency

Finally is a search that shows the number of events handled by each ES user.
| `incident_review| where _time>=relative_time(now(), "$timeframe.earliest$") AND _time<=relative_time(now(), "$timeframe.latest$") | stats sparkline,count,min(_time) as firstTime,max(_time) as lastTime by reviewer_realname | \uitime(firstTime)| \uitime(lastTime)` | sort 100 - count

View solution in original post

0 Karma

AndySplunks
Communicator

Here are some searches that cover my use cases:

This search will show review activity over time by user.
| `incident_review| where _time>=relative_time(now(), "$timeframe.earliest$") AND _time<=relative_time(now(), "$timeframe.latest$") | timechart useother=useother` count by reviewer_realname span=1d

This search is for notable events that are opened over time by their urgency.
| `notable` | search NOT suppression=* | timechart count by urgency

Finally is a search that shows the number of events handled by each ES user.
| `incident_review| where _time>=relative_time(now(), "$timeframe.earliest$") AND _time<=relative_time(now(), "$timeframe.latest$") | stats sparkline,count,min(_time) as firstTime,max(_time) as lastTime by reviewer_realname | \uitime(firstTime)| \uitime(lastTime)` | sort 100 - count

0 Karma

AndySplunks
Communicator

I'm making progress on this issue. I've got searches setup that work for timeframes that don't include 'now.' Previous Week works, Week To Date does not work. My Timepicker is named timeframe.

For the 'Review Activity By Reviewer' panel, I've got the following search setup:

| incident_review | where _time>=relative_time(now(), "$timeframe.earliest$") AND _time<=relative_time(now(), "$timeframe.latest$") | timechart useother=useother count by reviewer_realname

For 'Top Reviewers' panel, I've got the following search setup:

| incident_review | where _time>=relative_time(now(), "$timeframe.earliest$") AND _time<=relative_time(now(), "$timeframe.latest$") | stats sparkline,count,min(_time) as firstTime,max(_time) as lastTime by reviewer_realname | uitime(firstTime) | uitime(lastTime) | sort 100 - count

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...