You can add new dashboards, reports, views, links to filtered dashboards, or links to the web to your menu bar in Splunk Enterprise Security. You must have Splunk Enterprise Security administrator privileges to make changes to the menu bar navigation.
You can add views to the menu bar as part of a collection that groups several views together or as an individual item on the Splunk Enterprise Security menu bar. For example, Mission Control is an individual dashboard in the menu bar, and Audit is a collection of the audit dashboards.
If you customized your navigation bar in previous versions of Splunk Enterprise Security, you need to reset it in order to see the new navigation bar pages for version 8.0.0.
Check for updated views
Views and collections that are new, updated, or deprecated in the version of the app that you have installed are highlighted with small icons that indicate the relevant changes. The U and D icons are for purely informational purposes and no action is required.
After installing a new version of Splunk Enterprise Security or a new version of an app that provides views and collections for use in Splunk Enterprise Security, visit the Navigation page to check for updates to those views and collections.
Follow these steps to check for updated views in Splunk Enterprise Security:
- In the Splunk Enterprise Security app, select Configure.
- Select General settings, and then select Navigation. If any content is updated, the message "Some content updates available" appears at the top of the navigation editor.
- Look for icons on the views on the editor pane to find content that has been added, updated, or deprecated. These same icons also appear in the Add a new view and Add a new collection menus.
Set a default view for Splunk Enterprise Security
To see a specific view when you or other users open Splunk Enterprise Security, set a default view.
Follow these steps to set up a default view for Splunk Enterprise Security:
- In the Splunk Enterprise Security app, select Configure.
- Select General settings and then select Navigation.
- Locate the view that you want to be the default view.
- Select the checkmark icon that appears when you mouse over the view to Set this as the default view.
- Select Save to save your changes.
- Select OK to refresh the page and view your changes.
You can edit the existing navigation bar in Splunk Enterprise Security to customize it based on your requirements.
Follow these steps to edit the existing menu bar navigation:
- In the Splunk Enterprise Security app, select Configure.
- Select General settings and then select Navigation.
- Select and drag views or collections of views to change the location of the views or collections of views in the menu.
- Select the X next to a view or collection to remove it from the menu.
- Select the pencil icon to edit the name of a collection.
- Select the divider icon to add a divider and visually separate items in a collection.
- Select Save to save your changes.
- Select OK to refresh the page and view your changes.
You can add a new view to the menu bar of Splunk Enterprise Security without adding it to a collection.
Follow these steps to add a new view to Splunk Enterprise Security:
- In the Splunk Enterprise Security app, select Configure.
- Select General settings and then select Navigation.
- In the Navigation page, select Add a new view.
- Leave View Options set to the default of View.
- Select Select a View from Unused Views.
- Select a dashboard or view from the drop-down list.
- Select Save. The dashboard appears on the navigation editor.
- After you finish adding items to the menu, select Save to save your changes
- Select OK to refresh the page and view your changes.
Use a collection to organize several views or links together in the Splunk Enterprise Security menu bar.
Follow these steps to add a collection to the Splunk Enterprise Security menu bar:
- In the Splunk Enterprise Security app, select Configure.
- Select General settings, and then select Navigation.
- In the Navigation page, select Add a new collection.
- Enter a Name. For example, Audit.
- Select Save. The collection appears on the navigation editor.
You must add a view or link to the collection before it appears in the menu navigation.
Add a view to an existing collection
Add views to an existing collection of views.
Follow these steps to add a view to an existing collections of views:
- In the Splunk Enterprise Security app, select Configure.
- Select General settings, and then select Navigation.
- Locate the collection that you want to add views to.
- Select the view icon.
- Leave View Options set to the default of View.
- Select Select a View from Unused Views.
- Select a view from the list.
- Select Save. The view appears on the navigation editor.
- After you finish adding items to the menu, select Save to save your changes
- Select OK to refresh the page and view your changes.
You can add a link to the menu bar of Splunk Enterprise Security. For example, add a link to a specifically-filtered view of the Mission Control page or to an external ticketing system.
Follow these steps to create a link in the menu to an external system or webpage:
- In the Splunk Enterprise Security app, select Configure.
- Select General settings, and then select Navigation.
- Select Add a New View to add it to the menu, or locate an existing collection and select the icon to add the link to an existing collection of views.
- Select Link from View Options.
- Enter a Name to appear on the Splunk Enterprise Security menu. For example, Splunk Answers.
- Enter a link. For example, https://answers.splunk.com/
- Select Save.
- After you finish adding items to the menu, select Save to save your changes
- Select OK to refresh the page and view your changes.
Add a link to a filtered view of the Mission Control page
A common link to add to the menu bar is a filtered view of the Mission Control page
Follow these steps to add a link to a filtered view of the Mission Control page:
- Filter the Mission Control page with your desired filters. When you filter the dashboard, the URL updates with query string parameters matching your filters.
- In the web browser address bar, copy the part of the URL that starts with
/app/SplunkEnterpriseSecuritySuite/
and paste it in a plain text file for reference.
For example, if you filtered the dashboard to show only critical findings, the URL will includehttps://app/SplunkEnterpriseSecuritySuite/incident_review?form.selected_urgency=critical
.Be sure to append
https://
to the URL for completion. - In the Splunk Enterprise Security app, select Configure.
- Select General settings, and then select Navigation.
- Select Add a new view to add it to the menu or locate an existing collection and select the Add View icon to add the link to an existing collection of views.
- Select Link from View Options.
- Enter a Name to appear on the Splunk Enterprise Security menu. For example, IR - Critical.
- In the Link field, paste the URL section. For example,
/app/SplunkEnterpriseSecuritySuite/incident_review?form.selected_urgency=critical
- Select Save.
- After you finish adding items to the menu, select Save to save your changes.
- Select OK to refresh the page and view your changes.
If you add a link with multiple parameters, you must modify the query string parameters by adding &
. For example, enter the link for a filtered view of the Mission Control page that shows new and unassigned findings as /app/SplunkEnterpriseSecuritySuite/incident_review?form.status_form=1&form.owner_form=unassigned
.
You can also construct a URL manually using the parameters in the following table. Use an asterisk to show all results for a specific parameter. Not all parameters are required.
Parameter | Description | Possible values | Example |
---|---|---|---|
form.selected_urgency |
Displays findings with the urgency specified by this parameter. | critical, high, medium, low, informational | form.selected_urgency=critical
|
form.status_form |
Displays findings with the status specified by this parameter. An integer corresponds to each status value. | 0 for unassigned, 1 for new, 2 for in progress, 3 for pending, 4 for resolved, 5 for closed | form.status_form=0
|
form.owner_form |
Displays findings owned by the user specified by this parameter. | usernames | form.owner_form=admin
|
form.source |
Displays findings created by the detection specified by this parameter. HTML-encode spaces in the detection name and use the name that appears in the finding rather than the name that appears on the Content management page. | Endpoint - Host With Multiple Infections - Rule | form.source=Endpoint%20-%20Host%20With%20Multiple%20Infections%20-%20Rule
|
form.rule_name |
Displays findings created by the detection specified by this parameter. HTML-encode spaces in the detection name. Use the name that appears on the Content management page. | Host With Multiple Infections | form.rule_name=Host%20With%20Multiple%20Infections
|
form.tag |
Displays findings with the tag specified by this parameter. | malware, any custom tag value | form.tag=malware
|
form.srch |
Displays findings that match the SPL specified in this parameter. HTML-encode special characters such as = for key-value pairs. |
dest=127.0.0.1 | form.srch=dest%3D127.0.0.1
|
form.security_domain_form |
Displays findings in the security domain specified by this parameter. | access, endpoint, network, threat, identity, audit | form.security_domain_form=endpoint
|
earliest= and latest= |
Displays findings in the time range specified by these parameters. Specify a relative time range. HTML-encode special characters such as @. | -24h@h, now | earliest=-24h%40h&latest=now
|
form.new_urgency_count_form |
Displays findings that do not have the urgency specified by this parameter. | critical, high, medium, low, informational | form.new_urgency_count_form=informational
|
form.selected_urgency |
Displays findings that have the urgency specified by this parameter. Use multiple instances of this parameter to select multiple urgency settings. | critical, high, medium, low, informational | form.selected_urgency=critical&form.selected_urgency=high
|
event_id |
Displays the finding that matches the specified event_id . |
3C84A9D8-87F6-4066-8659-C7DD680F98E6@@notable@@80e0f89da83cad6665dd1de7447cedb4 | event_id=3C84A9D8-87F6-4066-8659-C7DD680F98E6@@notable@@80e0f89da83cad6665dd1de7447cedb4 |
form.association_type form.association_id |
Used together, displays the findings associated with a short ID or an investigation. | short_id, investigation EYIYNW, 5a4be2b8cdc9736b2352c7c3 |
form.association_type=short_id&form.association_id=EYIYNW
|
Restoring the default navigation resets any customization you made to the navigation bar in Splunk Enterprise Security.
Follow these steps to restore the default navigation of the Splunk Enterprise Security menu bar:
- Select Restore default configuration.
- Select OK to confirm.
- Select Save.
See also
For more information on how to configure user roles in Splunk Enterprise Security, see the product documentation:
Configure users and roles in Splunk Enterprise Security in the Install and Upgrade Splunk Enterprise Security Manual.
Manage credentials in Splunk Enterprise Security | Configure per-panel filtering in Splunk Enterprise Security |
This documentation applies to the following versions of Splunk® Enterprise Security: 8.0.0
Feedback submitted, thanks!