diff --git a/Splunk Dashboards/splunk_app_usage.xml b/Splunk Dashboards/splunk_app_usage.xml index 026e856..a0aecaa 100644 --- a/Splunk Dashboards/splunk_app_usage.xml +++ b/Splunk Dashboards/splunk_app_usage.xml @@ -40,7 +40,7 @@ index=_internal sourcetype=splunk_web_access host=* user=* | rex field=panel "\s+\<(?<panel_type>[^\<]+)\>" ``` filter for the types of panels that typically have searches ``` -| search panel_type IN ("chart","single","table","event","search","viz","map") +| search panel_type IN ("chart","single","table","event","search","viz","map","title") | search NOT app_name IN($myExcludedApps$) ``` total, sort and print the results ``` diff --git a/TA_dataset/default/data/ui/views/splunk_app_usage.xml b/TA_dataset/default/data/ui/views/splunk_app_usage.xml index 026e856..a0aecaa 100644 --- a/TA_dataset/default/data/ui/views/splunk_app_usage.xml +++ b/TA_dataset/default/data/ui/views/splunk_app_usage.xml @@ -40,7 +40,7 @@ index=_internal sourcetype=splunk_web_access host=* user=* | rex field=panel "\s+\<(?<panel_type>[^\<]+)\>" ``` filter for the types of panels that typically have searches ``` -| search panel_type IN ("chart","single","table","event","search","viz","map") +| search panel_type IN ("chart","single","table","event","search","viz","map","title") | search NOT app_name IN($myExcludedApps$) ``` total, sort and print the results ```