Managing glass tables

Glass tables allow you to visualize security metrics in your environment in a flexible way. Manage the glass tables included with Splunk Enterprise Security and the glass tables that you create yourself on the Glass Tables lister page.

• From the Splunk Enterprise Security menu bar, click Glass Tables.

Modify a glass table

After you create a glass table, you can continue to make changes to it.

1. From the list of glass tables, click Edit next to the glass table that you want to modify.
2. Choose whether you want to edit the glass table itself, edit the title or description, or edit permissions.

Clone a glass table to make a template

You can clone a glass table to make a template, or to preserve a glass table included with Splunk Enterprise Security as an original and make experimental changes on another version.

1. From the list of glass tables, click Edit next to the glass table that you want to modify.
2. Click Clone.
3. Type a new title.
4. (Optional) Type a new description.
5. (Optional) Change the permissions of the cloned glass table.
6. Click Clone Page.

Access to glass tables

All users can view glass tables, but you must have the ess_analyst, ess_admin, or admin role or have the capability to edit glass tables to create glass tables. See Configure users and roles.

Searches available to glass tables

Ad hoc search widgets that you create on individual glass tables cannot be shared automatically with other glass tables. Key indicator searches populate the list of security metrics available to add as predefined widgets, and those can be edited on the Content Management page. See Creating new content in Splunk Enterprise Security.

Performance and storage of glass tables

Glass table content is stored in the KV store. The glass table definitions are stored in the SplunkEnterpriseSecuritySuite_glasstables collection. Files added to glass tables, such as images, are stored in the SplunkEnterpriseSecuritySuite_files collection. Custom widgets, images, and other items that you add to a glass table are all stored in this collection.

The performance of individual glass tables depends on the number of search widgets on a glass table. When you open a glass table for viewing, each search runs at the same time. Searches on glass tables with 200 or more search widgets could take 10-15 seconds to show data on the glass table.