Dashboard Usage with filters used

[dudhatjanhavi]

Hi everyone,

I want to track/find which user used which dashboard at what time. I am able to do this by the information in index=_internal.

However, I also want to find out what dashboard filters the users added when they were looking at the dashboard.

We store this filter information in the dashboard URL. Is there maybe somewhere that Splunk collects the URLs of the dashboards visited? Then I can use a regex to scrape out the information I need. Or is there somewhere else I can find this information?

[dudhatjanhavi]

I was able to get it from there, I am not able to get the filter info correctly though. When I go to a dashboard splunk creates this log. However, when I change any filters, no more logs are created by Splunk, unless I refresh the dashboard. Even if the url updates when the filter is changed, no additional events are created in _internal. @richgalloway @PickleRick 

[PickleRick]

I suppose (but I haven't verified it - you can try to trace it with debugging tools on your browser) that most of the logic is done on the client's side and changing filters/parameters only modifies the resulting parameters sent with resulting search to search-head. These parameters are not passed to server as a part of dashboard request since they have no meaning for the server. It's the client who request the searches from search-head.

[dudhatjanhavi]

Ohh I see, do you know how else I can get that filter information then?

[PickleRick]

Short of checking what searches were spawned? I'm afraid you can't.

[PickleRick]

Maybe this will help you https://community.splunk.com/t5/Monitoring-Splunk/Used-reports-dashboards/m-p/572272

If your filters are included in the uri, you should get them this way

[richgalloway]

That information should be in the _internal index in one of the access logs.