Hello,
I have a quick question regarding dashboard. I would like to know if the search queries I have provided on dashboard panels can be applied after I input some value such as a user name. What I mean is that based on the username I provide on search head or wherever, the panels will give results. In other words, theses panels will give different results based on the username. Basically, I want to create a dashboard which summarize user activity.
Search queries I'm using are:
%Windows failed logins (count and source)
Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) |stats count by user dst src|fields user src dest count|rename dst as System|sort -count
%Windows failed logins (times)
Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) | bucket _time span=1h | stats count by _time user
%Windows successful logins
EventCode=4624 Logon_Type=10 |stats count by _time host, user, src |sort –count
If all fails, my plan is to mimic the time picker to create user picker... am I going in right direction?
Yes, you will need to create input fields and tokenize them so that the dashboard queries can pickup those queries and populate the tables.
For example, you can create a textfield with a token txt_tok
<input type="text" token="txt_tok">
<label>UserName</label>
</input>
and use the token in a dashbaord panel search query
Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) |stats count by $txt_tok$ dst src|fields $txt_tok$ src dest count|rename dst as System|sort -count
Yes, you will need to create input fields and tokenize them so that the dashboard queries can pickup those queries and populate the tables.
For example, you can create a textfield with a token txt_tok
<input type="text" token="txt_tok">
<label>UserName</label>
</input>
and use the token in a dashbaord panel search query
Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) |stats count by $txt_tok$ dst src|fields $txt_tok$ src dest count|rename dst as System|sort -count
works like magic! thanks!