All Apps and Add-ons

Box App for Splunk: How to clone File/Folder/User Events dashboard and modify searches for specific folders on our Box account?

jasoncornell
Explorer

We want to provide dashboards like the File/Folder/User Events but filtered down to specific folders on our Box account for reporting against. What is the best way to clone and edit the File/Folder/User Events dashboard to accomplish this? We want to clone the File/Folder/User Events dashboard in Splunk and change the filter to show the same data for only specific folders on our Box account. What do we change in the searches on this dashboard to accomplish this?

1 Solution

halr9000
Motivator

I would clone the dashboard (in this case, misc.xml), and then follow the instructions here in docs to add a form input to an existing dashboard. If you wanted to constrain the panels by a folder name for example, then that field is called "source.item_name". So, after adding a form field to make a new replacement token available to the panels, a search might look like this:

index=box source.item_type="file"  AND (event_type="preview" OR event_type="download" OR event_type="upload") source.item_name=$folder_name$ | dedup event_id | stats count by event_type

Note the "$folder_name$" token has to match the name that you use in the corresponding form field.

If you end up doing much work in this direction, I would suggest starting over, and use the form to filter a base search. Then you would change all of the panels to use the base search, instead of having a simultaneous search for each panel against the same data. You would use searchPostProcess, or in 6.2, the new search element.

View solution in original post

halr9000
Motivator

I would clone the dashboard (in this case, misc.xml), and then follow the instructions here in docs to add a form input to an existing dashboard. If you wanted to constrain the panels by a folder name for example, then that field is called "source.item_name". So, after adding a form field to make a new replacement token available to the panels, a search might look like this:

index=box source.item_type="file"  AND (event_type="preview" OR event_type="download" OR event_type="upload") source.item_name=$folder_name$ | dedup event_id | stats count by event_type

Note the "$folder_name$" token has to match the name that you use in the corresponding form field.

If you end up doing much work in this direction, I would suggest starting over, and use the form to filter a base search. Then you would change all of the panels to use the base search, instead of having a simultaneous search for each panel against the same data. You would use searchPostProcess, or in 6.2, the new search element.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...