All Apps and Add-ons

Box App for Splunk: How to clone File/Folder/User Events dashboard and modify searches for specific folders on our Box account?

jasoncornell
Explorer

We want to provide dashboards like the File/Folder/User Events but filtered down to specific folders on our Box account for reporting against. What is the best way to clone and edit the File/Folder/User Events dashboard to accomplish this? We want to clone the File/Folder/User Events dashboard in Splunk and change the filter to show the same data for only specific folders on our Box account. What do we change in the searches on this dashboard to accomplish this?

1 Solution

halr9000
Motivator

I would clone the dashboard (in this case, misc.xml), and then follow the instructions here in docs to add a form input to an existing dashboard. If you wanted to constrain the panels by a folder name for example, then that field is called "source.item_name". So, after adding a form field to make a new replacement token available to the panels, a search might look like this:

index=box source.item_type="file"  AND (event_type="preview" OR event_type="download" OR event_type="upload") source.item_name=$folder_name$ | dedup event_id | stats count by event_type

Note the "$folder_name$" token has to match the name that you use in the corresponding form field.

If you end up doing much work in this direction, I would suggest starting over, and use the form to filter a base search. Then you would change all of the panels to use the base search, instead of having a simultaneous search for each panel against the same data. You would use searchPostProcess, or in 6.2, the new search element.

View solution in original post

halr9000
Motivator

I would clone the dashboard (in this case, misc.xml), and then follow the instructions here in docs to add a form input to an existing dashboard. If you wanted to constrain the panels by a folder name for example, then that field is called "source.item_name". So, after adding a form field to make a new replacement token available to the panels, a search might look like this:

index=box source.item_type="file"  AND (event_type="preview" OR event_type="download" OR event_type="upload") source.item_name=$folder_name$ | dedup event_id | stats count by event_type

Note the "$folder_name$" token has to match the name that you use in the corresponding form field.

If you end up doing much work in this direction, I would suggest starting over, and use the form to filter a base search. Then you would change all of the panels to use the base search, instead of having a simultaneous search for each panel against the same data. You would use searchPostProcess, or in 6.2, the new search element.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...