topic Re: Top usernames in All Apps and Add-ons

Top usernames

ajstokvis — Thu, 20 Oct 2011 16:07:48 GMT

Hello,

How can i add a colum on the traffic dashboard just like Top client IP's, but then with the Top Usernames?

It may replace one of the other colums, but its not necessary

Is this possible? If yes, how?

Re: Top usernames

Ayn — Thu, 20 Oct 2011 19:01:18 GMT

Absolutely.

First of all, create a saved search that you can use in the dashboard. For reference, the saved search used for the Top 10 IP chart is called "Top 10 client IPs" and is as simple as:

sourcetype="squid" action="*" | top 10 clientip

Second, edit the dashboard XML. It's in the file SplunkforSquid/default/data/ui/views/dashboard.xml. In there you'll see a number of a number of sections beginning with HiddenSavedSearch modules. This is the one for the top client IP's:

<module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" group="Top client IPs" autoRun="True">
  <param name="useHistory">false</param>
  <param name="savedSearch">Top 10 client IPs</param>
  <module name="EnablePreview">
   <param name="enable">true</param>
   <param name="display">false</param>
   <module name="HiddenChartFormatter">
    <param name="chart">pie</param>
    <module name="FlashChart">
     <param name="height">300px</param>
     <module name="ViewRedirectorLink">
      <param name="viewTarget">flashtimeline</param>
      <param name="label">View full results</param>
     </module>
    </module>
   </module>
  </module>
 </module>

You can either simply change this section and switch the savedSearch name for the one you created for getting top usernames (and probably change the group name to get the correct label as well), or you can duplicate it if you want both charts in your dashboard. If you duplicate the section, make sure to update the layoutPanel to get the chart where you want.

Re: Top usernames

ajstokvis — Mon, 24 Oct 2011 13:53:44 GMT

Thank you very much!!
It works realy nice.

I have another question, is it possible to filter out one user?

I have 1 user that i dont want to see in the chart.
Can i make an exception for that user so that it dont show up in the chart?

Thank you very much for this, splunkforsquid is what i have been looking for a long time!!!

Re: Top usernames

Ayn — Mon, 24 Oct 2011 14:02:26 GMT

Sure, just filter out the user in your saved search. Something like this:

 search = sourcetype="squid" action="*" NOT username="theuser" | top 10 username

Great to hear that it's working and that it's useful! 🙂
Could you please mark my answer as accepted? That way it shows clearly on the site that this question got a valid answer.

Re: Top usernames

ajstokvis — Mon, 24 Oct 2011 14:09:38 GMT

Works again!!!

I might come with more questions in the future! 😉

Realy happy with this