Fix Dashboard Views collector: use splunkd_ui_access instead of splunkd_access

Author: devinslick

default/savedsearches.conf

@@ -8,11 +8,11 @@
 action.email.useNSSubject = 1
 alert.track = 0
 cron_schedule = */5 * * * *
-description = Collects dashboard view metrics from splunkd_access logs
+description = Collects dashboard view metrics from splunkd_ui_access logs
 dispatch.earliest_time = -5m
 dispatch.latest_time = now
 enableSched = 0
-search = index=_internal sourcetype=splunkd_access method=GET uri_path="/*/app/*" status=200 | rex field=uri_path "/[^/]+/app/(?<app>[^/]+)/(?<dashboard_name>[^/?]+)" | where isnotnull(dashboard_name) | eval dashboard_uri="/app/".app."/".dashboard_name | lookup dashboard_registry dashboard_uri OUTPUT pretty_name app as reg_app owner | where isnotnull(pretty_name) | stats count by dashboard_uri, pretty_name, app, user | eval activity_type="view", metric_name="dashboard.views" | mcollect index=caca_metrics split=t pretty_name app user activity_type
+search = index=_internal sourcetype=splunkd_ui_access uri_path="/*/app/*" | rex field=uri_path "/[^/]+/app/(?<app>[^/]+)/(?<dashboard_name>[^/?]+)" | where isnotnull(dashboard_name) | eval dashboard_uri="/app/".app."/".dashboard_name | lookup dashboard_registry dashboard_uri OUTPUT pretty_name app as reg_app owner | where isnotnull(pretty_name) | stats count by dashboard_uri, pretty_name, app, user | eval activity_type="view", metric_name="dashboard.views" | mcollect index=caca_metrics split=t pretty_name app user activity_type
 schedule_priority = default
 schedule_window = 5
 dispatchAs = owner
@@ -25,7 +25,7 @@ description = Collects dashboard edit/creation metrics from audit logs
 dispatch.earliest_time = -10m
 dispatch.latest_time = now
 enableSched = 0
-search = index=_audit action=edit_view OR action=create_view object_type=view | rex field=object "(?<app>[^:]+):(?<dashboard_name>.+)" | eval dashboard_uri="/app/".app."/".dashboard_name | lookup dashboard_registry dashboard_uri OUTPUT pretty_name app as reg_app owner | where isnotnull(pretty_name) | stats count by dashboard_uri, pretty_name, app, user, action | eval activity_type=if(action="create_view", "create", "edit"), metric_name="dashboard.edits" | mcollect index=caca_metrics split=t pretty_name app user activity_type
+search = index=_audit (action=rest_apps_view_post OR action=rest_apps_view_put) object_type=view OR object="*:*" | rex field=object "(?<app>[^:]+):(?<dashboard_name>.+)" | eval dashboard_uri="/app/".app."/".dashboard_name | lookup dashboard_registry dashboard_uri OUTPUT pretty_name app as reg_app owner | where isnotnull(pretty_name) | stats count by dashboard_uri, pretty_name, app, user, action | eval activity_type=if(action="rest_apps_view_post", "create", "edit"), metric_name="dashboard.edits" | mcollect index=caca_metrics split=t pretty_name app user activity_type
 schedule_priority = default
 schedule_window = 5
 dispatchAs = owner