Saved Filters in Mission Control

[clumicao]

Are we able to create a saved filter in Mission Control that can be shared across users? Just like in incident review in ES? 

[kiran_panchavat]

@clumicao 

I haven't worked on Mission Control before, but you can check this documentation – it might be helpful.

Apply filters and save filtered views for incidents

Triage incidents using incident review in Splunk Mission Control - Splunk Documentation

[asimit]

Hi @clumicao,

Currently, Mission Control does not have the same capability as Enterprise Security to create and share saved filters across users. In Mission Control, filters are saved locally to your browser and user profile, making them user-specific rather than shareable across a team.

There are a few workarounds you can use:

1. Document your most useful filters in a shared team document so others can manually recreate them
2. Use Mission Control's Export/Import feature to share filter configurations:
a. After creating a filter, click on the "Export" option in the filter panel
b. This will download a JSON configuration file
c. Share this file with team members
d. Other users can import this file using the "Import" option in their filter panel

Note that even with the import method, each user would need to import the filter individually, and any updates to the filter would require re-sharing and re-importing.

This has been a requested feature, and I recommend submitting it through the Splunk Ideas portal if it would be valuable for your team. The Splunk Mission Control team is regularly enhancing the product based on user feedback.

Please give 👍 for support 😁 happly splunking .... 😎