I've built a dashboard panel that looks for blocked web traffic in real-time. Everything works great except I cannot pause/resume the search if I see something I want to investigate. Like I can using the default Splunk search bar but I don't see any options to add the pause/resume buttons to the dashboard searches. I've looked into using Sideview Utils but I was never able to get their modules working in my dashboards. I also read that advanced XML support is going away in Splunk so I am hesitant to use the Sideview Utils add-on in fear that it may not be supported in future version of Splunk. What are my options? ... View more

I have a dashboard panel search that contains a subsearch that returns formatted results from three source types based on the username entered in the search field: blocked OR deny [search sourcetype=pan:traffic | where user="mydomain\\$userName$" | rename src_ip AS src | fields src] | eval "Source IP" = coalesce(src, src_ip, src_host) | eval "Destination IP" = coalesce(dst, dst_ip, dest_ip) | eval "Destination Port" = coalesce(dst_port, dest_port) | eval "Application" = coalesce(service, appname, application) | eval "Destination Zone" = coalesce(dst_zone, dest_zone) | table _time, sourcetype, "Source IP", "Destination IP", "Destination Port", url, "Application", category, src_zone, "Destination Zone", policy_id, action Currently the search above returns all events in a specified time frame which can be chosen from a drop-down box. However, I want to modify this search to return only the latest IP that matches the username and use it as the input to another search panel that will then kick off a real-time last 30 second search. This in theory should let me see what device is blocking or denying a user from accessing something on the network. The second search below will return the results I want within the time frame, but I have to manually enter the IP: blocked OR deny | search src="$IP$" OR src_ip="$IP$" | eval "Source IP" = coalesce(src, src_ip, src_host) | eval "Destination IP" = coalesce(dst, dst_ip, dest_ip) | eval "Destination Port" = coalesce(dst_port, dest_port) | eval "Application" = coalesce(service, appname, application) | eval "Destination Zone" = coalesce(dst_zone, dest_zone) | table _time, sourcetype, "Source IP", "Destination IP", "Destination Port", url, "Application", category, src_zone, "Destination Zone", policy_id, action Is it possible to feed the IP from the first search into the second panel and still retain the ability to manually enter it? How is this accomplished? Are more panel needed? I have to do this because sub search strings don't work in real time! Also only the PaloAlto device knows users by username, the Websense and the Juniper only know the IP. Another issue I see with this is the time frame for finding the user's IP by username. Right now the search window in the first search is set to 15 minutes. Is there some logic I can use to go beyond that 15 minutes if a pan:traffic log matching the user name is not found within the current time frame? Any/all ideas are welcome 🙂 ... View more