Splunk® SOAR (On-premises)

Administer Splunk SOAR (On-premises)

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Configure the ROI Settings dashboard

Configure the parameters used to estimate the data displayed in the Automation ROI Summary dashboard.

Setting Description
FTE Gained Enable this toggle make the FTE Gained widget available in the Automation ROI Summary dashboard.


To calculate this value, divides the number of actions run by automation (calculated in ) by the number of expected actions an analyst would take, based on minutes per action and analyst hours per day (configured on the ROI settings page).

Time Saved Enable this toggle make the Time saved widget available in the Automation ROI Summary dashboard.


To calculate this value, sums the difference between the Analyst Minutes Per Action (configured on the ROI settings page) and the actual minutes per action (calculated in ) over all actions for the past 24 hours.

Money Saved Enable this toggle make the Dollars saved widget available in the Automation ROI Summary dashboard.


To calculate this value, multiplies the average time an analyst spends per action and the average analyst salary (configured on the ROI settings page) by the number of actions run by automation (calculated in ).

Annual analyst salary The average annual salary paid to each analyst.
Currency The national currency value you want to use in the display.
Analyst hours per day The typical number of hours each analyst works per day.
Minutes per action The average number of minutes an analyst typically spends on any action in a case.

Use the Splunk App for Phantom Reporting to view more granular breakdowns of individual action runtimes. The Splunk App for Phantom Reporting sends log data back to the Splunk platform. You can use this data to generate or modify reports as needed.

The Splunk App for Phantom Reporting is not supported by Splunk. See App support types in Working with Splunkbase.

Last modified on 13 March, 2023
PREVIOUS
Configure your company settings in
  NEXT
Obtain and configure a license

This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.1.0, 5.2.1, 5.3.1, 5.3.2


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters