1. Tony Vincent

      Security Owl–From the “Search and Reporting” app, click Dashboards, then the big green button to create a new dashboard. Name the dashboard and click create. Now you are in the “edit dashboard” screen, click SOURCE, delete EVERYTHING there, and replace it with the above dashboard XML. -tv

      1. Splunk Senpai

        The problem is that the User field input is not configured correctly. It does nothing actually. I’m working on fixing the input, test it and post the code here

        1. thall

          Afternoon, the field input at the top of the dashboard is designed to be a generic filter and not tied to any specific field. If you want you can either enter a value or field=value and it should filter the dashboard accordingly. I pulled the dashboard in my home environment and everything works including the drilldown and the field input. Unless you a speaking of a different part of the dashboard.


  1. DFlow

    Heads up… Login type 10 is remote interactive (i.e. RDP, Terminal Services, Remote Assistance), however login type 2 is an interactive login (i.e. by typing user name and password on Windows logon prompt).

Leave A Comment?