Changes to the splunkd_ui_access.log

[fatsug]

I had this search set up:

index=_internal source=*splunkd_ui_access.log /app NOT(user="-" OR uri_path="*/app/*/search")

To be able to audit dashboard usage. After updating to 9.1.1 there were very limited numbers of events matching this search.

After a bit of digging it seems that what used to be

"GET /en_US/app/<appname>/<dashboard> HTTP/1.1"

is no longer there and the '/app' URI part no longer points to dashboards. I can find the dashboards accessed instead as

"GET /en-US/splunkd/__raw/servicesNS/<user>/<dashboard>/data/ui/<lots>/<more>

As best as I can see, the information I am interrested in seems to now reside in the "web_access.log" instead, which previously contained a lot more information (like the __raw log now). The events in this log file looks like this:

"GET /en-GB/app/<app>/<dashboard> HTTP/1.1"

  So I need to modify the original search to exclude launcher and a different pattern for search etc.

My question is if this is the correct and optimal approach, to work with the "web_access.log" instead of the now seemingly harder to work with "splunkd_ui_access.log". Or should I be looking at some other source or in some other way?

[fatsug]

It seems that this picks upp ALL web access so the exclude list needs to be a lot more complicated as every accessed URI ends up here ".../dashboards", "...report", -"...reports" etc. So this would work but the search will need to be a lot more complicated then before.

Any suggestions on how to accomplish a search for dashboards visited  are much appreciated.