I have a dashboard with the following specs and like to see how often this dashboard is used :
SPECS (Dashboard):
1 input (text) - where user can type in a email address
~20 search panels which generates charts/reports depending on the email address which is typed into the input field
I like to monitor, using the internal Splunk log files, how often the dashboard is used. Each time the dashboard is used with a filled input the count should be increased by one.
Example (for new usage):
- User is typing in manually a new email address inside the dashboard
- User is using a link to the open that dashboard where an email address is already included as a parameter
I didn't find a proper way yet. I thought this muss be possible using the _internal Splunk log files but it didn't seem so. I tried using the web_access.log and remote_searches.log but both sources couldn't show me a valid result.
Any ideas ?
Thanks,
Thorsten
With the assumption that the events in the logs that are within 2 minutes of eachother this should give you the infor you want. replace <myappname>
and <mydashboard>
with the appropriate app_name and dashboard_name.
index=_internal source=*/web_access.log*
| search "/app/" AND "POST"
|rex "\/\/\w+\:\d{4}\/en-US\/app\/(?<app>\w+)\/(?<view_name>\w+)"
|search app="<myappname>" AND view_name="<mydashboard>"
| transaction referer maxspan=2m
|table _time,app,view_name,user,form_email
or
index=_internal source=*/web_access.log*
| search "/app/" AND "POST"
|rex "\/\/\w+\:\d{4}\/en-US\/app\/(?<app>\w+)\/(?<view_name>\w+)"
|search app="<myappname>" AND view_name="<mydashboard>"
| transaction referer maxspan=2m |timechart count(form_email) by user