I was wondering if it was possible to add a filter to one of the dashboards in the Palo Alto Networks App for Splunk?
I want to be able to filter the traffic dashboard by src_zone.
I can, of course, drilldown and filter within the search but I want the filter to be on the dashboard.
I have never created or altered a dashboard before.
I would make a copy of it and edit that. Go to Settings
-> Searches, Reports, and Alerts
-> select your app in the App Context
listbox in the upper-left -> in the search bar on the upper-right, search for your dashboard, when you find it -> Clone
-> then click Run
-> then Edit
and go from there.
I would make a copy of it and edit that. Go to Settings
-> Searches, Reports, and Alerts
-> select your app in the App Context
listbox in the upper-left -> in the search bar on the upper-right, search for your dashboard, when you find it -> Clone
-> then click Run
-> then Edit
and go from there.
I can't find that dashboard in Settings -> Searches, Reports, and Alerts
If I go back to the dashboard within the app and select edit permissions, I get the following info:
Dashboard: Traffic Dashboard
Owner: nobody
App: SplunkforPaloAltoNetworks
Not sure where to find it.
When you run the dashboard, take the string on the URL bar from the last /
through to the ?
and that is the name of the dashboard. Then go to Searches, Reports, and Alerts
and paste that name string in the search box.
Alternatively, replace everything after the ?
with showsource=true
and copy the XML and then just paste it into your own "new" dashboard.
I was able to clone it, find the cloned dashboard and alter the XML but how do you add it to the menus so I can run the customized version within the app?
nevermind...got that to work
had to add the view to the user interface
thanks for the help