How to monitor Splunk dashboard usage using internal Splunk log files?

[tries]

I have a dashboard with the following specs and like to see how often this dashboard is used :

SPECS (Dashboard):
1 input (text) - where user can type in a email address
~20 search panels which generates charts/reports depending on the email address which is typed into the input field

I like to monitor, using the internal Splunk log files, how often the dashboard is used. Each time the dashboard is used with a filled input the count should be increased by one.

Example (for new usage):
- User is typing in manually a new email address inside the dashboard
- User is using a link to the open that dashboard where an email address is already included as a parameter

I didn't find a proper way yet. I thought this muss be possible using the _internal Splunk log files but it didn't seem so. I tried using the web_access.log and remote_searches.log but both sources couldn't show me a valid result.

Any ideas ?

Thanks,
Thorsten

[jdastmalchi_spl]

With the assumption that the events in the logs that are within 2 minutes of eachother this should give you the infor you want. replace <myappname> and <mydashboard> with the appropriate app_name and dashboard_name.


index=_internal source=*/web_access.log*
| search "/app/" AND "POST"
|rex "\/\/\w+\:\d{4}\/en-US\/app\/(?<app>\w+)\/(?<view_name>\w+)"
|search app="<myappname>" AND view_name="<mydashboard>"
| transaction referer maxspan=2m
|table _time,app,view_name,user,form_email


or


index=_internal source=*/web_access.log*
| search "/app/" AND "POST"
|rex "\/\/\w+\:\d{4}\/en-US\/app\/(?<app>\w+)\/(?<view_name>\w+)"
|search app="<myappname>" AND view_name="<mydashboard>"
| transaction referer maxspan=2m |timechart count(form_email) by user