From 4edd5efb513ab633f4df2f70c0f4efa380efb3ed Mon Sep 17 00:00:00 2001
From: bpatel <bpatel@splunk.com>
Date: Mon, 5 Apr 2021 12:49:41 -0700
Subject: [PATCH] show mustang content by product

---
 dist/mustang/default/data/ui/views/escu_summary.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dist/mustang/default/data/ui/views/escu_summary.xml b/dist/mustang/default/data/ui/views/escu_summary.xml
index f1751b5e3f..55235720ef 100644
--- a/dist/mustang/default/data/ui/views/escu_summary.xml
+++ b/dist/mustang/default/data/ui/views/escu_summary.xml
@@ -3,11 +3,11 @@
   <!-- Example uses stats transforming command -->
   <!-- This limits evnts passed to post-process search -->
   <title>Splunk Security Content</title>
-  <search id="baseSS">
-    <query>| rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *"</query>
+   <search id="baseSS">
+    <query>| rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" action.escu.product="*Splunk Security Analytics for AWS*"</query>
   </search>
   <search id="baseAS">
-    <query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0</query>
+    <query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 product="*Splunk Security Analytics for AWS*"</query>
   </search>
   <init>
     <set token="form.as_category">*</set>