Customize a table view in Splunk UBA

You can choose what to view in a Splunk UBA table such as the Users Table or Device Table. Change the columns that appear, filter the results, and group the results as you see fit.

Customize a table view in the following ways:

• Select the table icon to change which columns display and view additional or fewer columns of information.
• Select and drag column headers to reorder them, or click them to sort the table by the column value.
• See grouped versions of the table by clicking the arrows to the left of the columns to expand the grouping selector. Select from the available options, or choose No Grouping to see all users with anomalies.
• You can also narrow your view using the filters. Filter by risk score, time, or select Add Filter to include additional filters.

You can save your customizations as a filter, a CSV file, or as a dashboard widget.

Save a view

Save a view so that you can return to it later. You can save a filter to reuse a specific set of search criteria, or you can save dashboard panels or tables.

You can save tables, such as the User Table or the Anomalies Table, as CSV files, HTML files, or dashboard widgets. See Save to a dashboard.

You can save dashboard panels as CSV files or HTML files if they contain tabular data. Other types of dashboard panels, such as charts or graphs, can be saved as images or PDF files.

Save a filter

Save and name a filter to use it again. Filters you create and save are visible to all users of Splunk UBA.

1. Click Add Filter to add a new filter to your table view. For example, select a filter of Threat Types and select Insider to see only insider threats.
2. Click Save.
3. Enter a Name.
   For example, Insider threats.

Click Clear Filters to return to viewing all users. Click Presets to view all saved filters.

You can also rename or modify existing filters.

1. Click the filter name and select Manage Presets.
2. Type in the box to edit the name, or click the X to delete the filter.
3. Click OK to save your changes.

Save to a dashboard

You can create a custom dashboard widget or panel from the user table view. This lets you save a filter view as a visualization on a dedicated dashboard.

1. Click Save and select Save as Dashboard Widget.
2. Enter a Widget Name.
3. Select a Widget Dashboard, such as Custom Dashboard.
4. Click Next.
5. Select a visualization type.
6. Click OK to save the widget.
7. When prompted, click Show Dashboard Widget.
8. The Custom Dashboards view opens and displays your new dashboard widget.

For more information, see Create a custom dashboard.