Cross Team Search on Dashboards

Introduction

Our Engineering Team recently released a new feature that allows you to do Cross Team Search on Dashboards via JSON.

Configuration

To do a Cross Team Search with a dashboard we will first run a search selecting multiple teams. We will then create a graph and save the graph to a dashboard. To select multiple teams we will go to the Search page and click on the people icon on the upper left corner of the screen.

From here we create a graph by clicking on the status_code facet and selecting #Matches.  Note: We also added in the search status_code=500

From the Graph, we will break down by serverHost and select save to Dashboard from the save menu.  

Once the Graph is saved to the dashboard we will click

Now that we are in our dashboard to verify which teams are being searched in the graph.
We can click on the three dots in the upper right corner of the screen and select Edit JSON. In the JSON under teamEmails it lists the teams that are being searched to create the graph.  

Sample JSON

{
  "graphStyle": "line",
  "lineSmoothing": "straightLines",
  "breakdownFacet": "serverHost",
  "teamEmails": [
    "jane.doe@sentinelone.com",
    "demo@sentinelone.com"
  ],
  "title": "Cross Team Status = 500  by serverHost",
  "plots": [
    {
      "filter": "status_code = 500 ",
      "label": "rate",
      "facet": "rate"
    }
  ]
}