All Apps and Add-ons

Box App for Splunk: How to clone File/Folder/User Events dashboard and modify searches for specific folders on our Box account?

jasoncornell
Explorer

We want to provide dashboards like the File/Folder/User Events but filtered down to specific folders on our Box account for reporting against. What is the best way to clone and edit the File/Folder/User Events dashboard to accomplish this? We want to clone the File/Folder/User Events dashboard in Splunk and change the filter to show the same data for only specific folders on our Box account. What do we change in the searches on this dashboard to accomplish this?

1 Solution

halr9000
Motivator

I would clone the dashboard (in this case, misc.xml), and then follow the instructions here in docs to add a form input to an existing dashboard. If you wanted to constrain the panels by a folder name for example, then that field is called "source.item_name". So, after adding a form field to make a new replacement token available to the panels, a search might look like this:

index=box source.item_type="file"  AND (event_type="preview" OR event_type="download" OR event_type="upload") source.item_name=$folder_name$ | dedup event_id | stats count by event_type

Note the "$folder_name$" token has to match the name that you use in the corresponding form field.

If you end up doing much work in this direction, I would suggest starting over, and use the form to filter a base search. Then you would change all of the panels to use the base search, instead of having a simultaneous search for each panel against the same data. You would use searchPostProcess, or in 6.2, the new search element.

View solution in original post

halr9000
Motivator

I would clone the dashboard (in this case, misc.xml), and then follow the instructions here in docs to add a form input to an existing dashboard. If you wanted to constrain the panels by a folder name for example, then that field is called "source.item_name". So, after adding a form field to make a new replacement token available to the panels, a search might look like this:

index=box source.item_type="file"  AND (event_type="preview" OR event_type="download" OR event_type="upload") source.item_name=$folder_name$ | dedup event_id | stats count by event_type

Note the "$folder_name$" token has to match the name that you use in the corresponding form field.

If you end up doing much work in this direction, I would suggest starting over, and use the form to filter a base search. Then you would change all of the panels to use the base search, instead of having a simultaneous search for each panel against the same data. You would use searchPostProcess, or in 6.2, the new search element.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...