Splunk® Enterprise Security

Use Splunk Enterprise Security

Download manual as PDF

Splunk Enterprise Security version 4.6.x is available only to Splunk Cloud subscribers.
This documentation does not apply to the most recent version of ES. Click here for the latest version.
Download topic as PDF

Managing glass tables

Glass tables allow you to visualize security metrics in your environment in a flexible way. Manage the glass tables included with Splunk Enterprise Security and the glass tables that you create yourself on the Glass Tables lister page.

  • From the Splunk Enterprise Security menu bar, click Glass Tables.

Modify a glass table

After you create a glass table, you can continue to make changes to it.

  1. From the list of glass tables, click Edit next to the glass table that you want to modify.
  2. Choose whether you want to edit the glass table itself, edit the title or description, or edit permissions.

Clone a glass table to make a template

You can clone a glass table to make a template, or to preserve a glass table included with Splunk Enterprise Security as an original and make experimental changes on another version.

  1. From the list of glass tables, click Edit next to the glass table that you want to modify.
  2. Click Clone.
  3. Type a new title.
  4. (Optional) Type a new description.
  5. (Optional) Change the permissions of the cloned glass table.
  6. Click Clone Page.

Access to glass tables

All users can view glass tables, but you must have the ess_analyst, ess_admin, or admin role or have the capability to edit glass tables to create glass tables. See Configure users and roles.

Searches available to glass tables

Ad hoc search widgets that you create on individual glass tables cannot be shared automatically with other glass tables. Key indicator searches populate the list of security metrics available to add as predefined widgets, and those can be edited on the Content Management page. See Creating new content in Splunk Enterprise Security.

Performance and storage of glass tables

Glass table content is stored in the KV store. The glass table definitions are stored in the SplunkEnterpriseSecuritySuite_glasstables collection. Files added to glass tables, such as images, are stored in the SplunkEnterpriseSecuritySuite_files collection. Custom widgets, images, and other items that you add to a glass table are all stored in this collection.

The performance of individual glass tables depends on the number of search widgets on a glass table. When you open a glass table for viewing, each search runs at the same time. Searches on glass tables with 200 or more search widgets could take 10-15 seconds to show data on the glass table.

PREVIOUS
Create a glass table
  NEXT
Audit dashboards

This documentation applies to the following versions of Splunk® Enterprise Security: 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.6.0 Cloud only


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters