All Apps and Add-ons

Top usernames

ajstokvis
New Member

Hello,

How can i add a colum on the traffic dashboard just like Top client IP's, but then with the Top Usernames?

It may replace one of the other colums, but its not necessary

Is this possible? If yes, how?

0 Karma
1 Solution

Ayn
Legend

Absolutely.

First of all, create a saved search that you can use in the dashboard. For reference, the saved search used for the Top 10 IP chart is called "Top 10 client IPs" and is as simple as:

sourcetype="squid" action="*" | top 10 clientip

Second, edit the dashboard XML. It's in the file SplunkforSquid/default/data/ui/views/dashboard.xml. In there you'll see a number of a number of sections beginning with HiddenSavedSearch modules. This is the one for the top client IP's:

<module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" group="Top client IPs" autoRun="True">
  <param name="useHistory">false</param>
  <param name="savedSearch">Top 10 client IPs</param>
  <module name="EnablePreview">
   <param name="enable">true</param>
   <param name="display">false</param>
   <module name="HiddenChartFormatter">
    <param name="chart">pie</param>
    <module name="FlashChart">
     <param name="height">300px</param>
     <module name="ViewRedirectorLink">
      <param name="viewTarget">flashtimeline</param>
      <param name="label">View full results</param>
     </module>
    </module>
   </module>
  </module>
 </module>

You can either simply change this section and switch the savedSearch name for the one you created for getting top usernames (and probably change the group name to get the correct label as well), or you can duplicate it if you want both charts in your dashboard. If you duplicate the section, make sure to update the layoutPanel to get the chart where you want.

View solution in original post

Ayn
Legend

Absolutely.

First of all, create a saved search that you can use in the dashboard. For reference, the saved search used for the Top 10 IP chart is called "Top 10 client IPs" and is as simple as:

sourcetype="squid" action="*" | top 10 clientip

Second, edit the dashboard XML. It's in the file SplunkforSquid/default/data/ui/views/dashboard.xml. In there you'll see a number of a number of sections beginning with HiddenSavedSearch modules. This is the one for the top client IP's:

<module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" group="Top client IPs" autoRun="True">
  <param name="useHistory">false</param>
  <param name="savedSearch">Top 10 client IPs</param>
  <module name="EnablePreview">
   <param name="enable">true</param>
   <param name="display">false</param>
   <module name="HiddenChartFormatter">
    <param name="chart">pie</param>
    <module name="FlashChart">
     <param name="height">300px</param>
     <module name="ViewRedirectorLink">
      <param name="viewTarget">flashtimeline</param>
      <param name="label">View full results</param>
     </module>
    </module>
   </module>
  </module>
 </module>

You can either simply change this section and switch the savedSearch name for the one you created for getting top usernames (and probably change the group name to get the correct label as well), or you can duplicate it if you want both charts in your dashboard. If you duplicate the section, make sure to update the layoutPanel to get the chart where you want.

ajstokvis
New Member

Works again!!!

I might come with more questions in the future! 😉

Realy happy with this

0 Karma

Ayn
Legend

Sure, just filter out the user in your saved search. Something like this:

 search = sourcetype="squid" action="*" NOT username="theuser" | top 10 username

Great to hear that it's working and that it's useful! 🙂
Could you please mark my answer as accepted? That way it shows clearly on the site that this question got a valid answer.

0 Karma

ajstokvis
New Member

Thank you very much!!
It works realy nice.

I have another question, is it possible to filter out one user?

I have 1 user that i dont want to see in the chart.
Can i make an exception for that user so that it dont show up in the chart?

Thank you very much for this, splunkforsquid is what i have been looking for a long time!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...