Box App for Splunk: How to clone File/Folder/User Events dashboard and modify searches for specific folders on our Box account?

[jasoncornell]

We want to provide dashboards like the File/Folder/User Events but filtered down to specific folders on our Box account for reporting against. What is the best way to clone and edit the File/Folder/User Events dashboard to accomplish this? We want to clone the File/Folder/User Events dashboard in Splunk and change the filter to show the same data for only specific folders on our Box account. What do we change in the searches on this dashboard to accomplish this?

[halr9000 · Accepted solution]

I would clone the dashboard (in this case, misc.xml), and then follow the instructions here in docs to add a form input to an existing dashboard. If you wanted to constrain the panels by a folder name for example, then that field is called "source.item_name". So, after adding a form field to make a new replacement token available to the panels, a search might look like this:

index=box source.item_type="file"  AND (event_type="preview" OR event_type="download" OR event_type="upload") source.item_name=$folder_name$ | dedup event_id | stats count by event_type

Note the "$folder_name$" token has to match the name that you use in the corresponding form field.

If you end up doing much work in this direction, I would suggest starting over, and use the form to filter a base search. Then you would change all of the panels to use the base search, instead of having a simultaneous search for each panel against the same data. You would use searchPostProcess, or in 6.2, the new search element.