@martin_mueller, where do you configure users to see the views. ... View more

@VatsalJagani, i did a test using my dev box using a test_app which has the nav tag and i am getting the same results. Sharing is app and permissions are read for everyone and write for admin. ... View more

Yes i followed the one on top, view name changed is user_group_changes from the xml ... View more

<view name="flashtimeline" /> <collection label="Splunk health"> <view name="license_usage" /> <view name="data_inputs_health" /> </collection> <collection label="Access"> <view name="authentication_summary" default='true' /> <view name="hp-ux_authentication" /> <view name="hp-ux_sudo" /> <view name="aix_authentication" /> <view name="aix_sudo" /> </collection> <collection label="Account control"> <view name="user_account_changes" /> <view name="user_group_changes" /> </collection> <collection label="Auditing"> <view name="cron_jobs" /> <view name="ssh_non_interactive_commands" /> <view name="windows_file_audit" /> </collection> <collection label="Reports"> <collection label="User Audit"> <collection label="HP-UX"> <saved source="unclassified" match="HPux_report" /> </collection> <collection label="AIX"> <saved source="unclassified" match="AIX_report" /> </collection> <collection label="Windows"> <view name="report1" /> <view name="report2" /> <view name="report3" /> <view name="report4" /> </collection> </collection> <collection label="Searches"> <collection label="**"> <saved source="unclassified" match="Syslog" /> </collection> </collection> The view that i have added is user_group_changes which is not showing on the dashboard. ... View more

Thanks ansif. This was solved after the exchange admin enabled specific actions to be audited on the mailboxes that needed auditing as recommended by Microsoft. Once that was done an audit folder was created on the Exchange server and audit logs started coming to splunk. But SharePoint still no luck. ... View more