Splunk® App for PCI Compliance

User Manual

This documentation does not apply to the most recent version of Splunk® App for PCI Compliance. For documentation on the most recent version, go to the latest release.

Investigation Bar

When viewing dashboards within , an Investigation Bar is visible at the bottom. ES41InvestigationBar.png

Begin an investigation

You can create a new investigation timeline by clicking Create a New Investigation

  • Load an existing investigation timeline by clicking All Investigations and selecting a timeline.

Work an existing investigation

Load an existing investigation timeline into the bar by clicking All Investigations and selecting an investigation.

  • Change the investigation name by clicking Edit Investigation Name.
  • View the timeline of the investigation, or close it after you open it, by clicking Toggle Timeline.
  • Add a note by clicking Notes.
  • Add an item from your action history by clicking Action History.

Run a quick search

Run a search without needing to open the search dashboard by clicking Quick Search.

  • Enlarge or shrink your view of the search results by clicking and dragging the corner of the window. Double click to expand the search view to cover most of your screen, or double click again to shrink it.
  • Click Open in Search to view the search results on the Search dashboard.
  • Click Export to export the search results as a CSV file. You can then add those search results as an attachment to the timeline. See Investigation Timelines.
  • Quickly add the search to the investigation in the investigation bar by clicking Add to Investigation.
Last modified on 12 April, 2017
Predictive Analytics dashboard   Asset and Identity Correlation

This documentation applies to the following versions of Splunk® App for PCI Compliance: 3.3.1, 3.3.2, 3.3.3, 3.3.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters