This app was created to streamline the tedious and often mundane task of auditing end-user searches. If you're ok with users being able to see each other's content (in a roundabout way), this can also be used as a self-audit tool.
This app should only be installed and configured on search heads.
There are 4 knowledge objects that need to be configured prior to use
dx_search_tier macro, modify the host field to match the splunk host name where this app is installed. If running on a search head cluster, match all cluster members. Ex... host=splunk-shc0*.dx_search_tier macro. Adjust the cron schedules as needed:Generating Lookup for dx_savedsearch_audit: Do not run as a user. Must run as nobody/splunk-system-userGenerating Lookup for dx_savedsearch_perf: Can be run manually to populate initial dataearliest time. This will determine the time period performance statistics are calculated over. The default value is -30d.Generating Lookup for dx_dashboard_audit: Do not run as a user. Must run as nobody/splunk-system-userBy default, this app is visible to end users. Only members of the admin and sc_admin roles can see all user content within the dashboard. Users not in any of those roles can only see their own content within the dashboard. These can be modified via the dx_user_filter macro.
local.meta. I plan on addressing this in a future release/iteration of this app.alerts.xml, analytics_workspace.xml, dashboards.xml, datasets.xml, reports.xml, and search.xml.<?xml version="1.0"?>
<view template="dx_savedsearch_audit:/templates/redirect.html" type="html">
<label>Saved Search Audit - Oops, you shouldn't be here...</label>
</view>
This app is currently in beta and is developer supported. I'll do my best to assist anyone that reaches out.
Initial beta version for SplunkBase
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.