I had this search set up:
index=_internal source=*splunkd_ui_access.log /app NOT(user="-" OR uri_path="*/app/*/search")
To be able to audit dashboard usage. After updating to 9.1.1 there were very limited numbers of events matching this search.
After a bit of digging it seems that what used to be
"GET /en_US/app/<appname>/<dashboard> HTTP/1.1"
is no longer there and the '/app' URI part no longer points to dashboards. I can find the dashboards accessed instead as
"GET /en-US/splunkd/__raw/servicesNS/<user>/<dashboard>/data/ui/<lots>/<more>
As best as I can see, the information I am interrested in seems to now reside in the "web_access.log" instead, which previously contained a lot more information (like the __raw log now). The events in this log file looks like this:
"GET /en-GB/app/<app>/<dashboard> HTTP/1.1"
So I need to modify the original search to exclude launcher and a different pattern for search etc.
My question is if this is the correct and optimal approach, to work with the "web_access.log" instead of the now seemingly harder to work with "splunkd_ui_access.log". Or should I be looking at some other source or in some other way?
It seems that this picks upp ALL web access so the exclude list needs to be a lot more complicated as every accessed URI ends up here ".../dashboards", "...report", -"...reports" etc. So this would work but the search will need to be a lot more complicated then before.
Any suggestions on how to accomplish a search for dashboards visited are much appreciated.