Comprehensive rewrite: Add configurable settings and improve collectors

Author: devinslick

README.md

@@ -77,7 +77,7 @@ The app uses a three-stage pipeline for efficiency:
 All searches are configured with **low priority** to ensure they do not impact regular user searches or system performance. The searches use efficient `mcollect` commands to write directly to a metrics index, minimizing resource consumption.
 
 ## Status
-DRAFT - Work in Progress
+Version 1.0.0 - Production Ready
 
 ## Requirements
 
@@ -406,6 +406,39 @@ Edit `default/indexes.conf` to adjust retention:
 frozenTimePeriodInSecs = 31536000  # 1 year (default)
 ```
 
+### Configurable Thresholds
+
+CACA uses configurable thresholds stored in `lookups/caca_settings.csv`. You can customize these settings to match your environment:
+
+| Setting | Default | Description |
+|---------|---------|-------------|
+| `error_threshold_warning` | 1 | Number of errors to trigger warning status |
+| `error_threshold_critical` | 10 | Number of errors to trigger critical status |
+| `load_time_fast` | 1000 | Load time (ms) considered fast |
+| `load_time_good` | 3000 | Load time (ms) considered good |
+| `load_time_slow` | 5000 | Load time (ms) considered slow |
+| `load_time_critical` | 10000 | Load time (ms) considered critical |
+| `stale_threshold_days` | 30 | Days without views to consider dashboard stale |
+| `engagement_edit_weight` | 2 | Weight multiplier for edits in engagement score |
+| `engagement_error_penalty` | 5 | Penalty multiplier for errors in engagement score |
+| `low_engagement_threshold` | 20 | Views below this in 30 days is low engagement |
+| `vip_percentile` | 90 | Percentile threshold for VIP/gem dashboards |
+
+**To modify settings:**
+1. Navigate to **Settings → Lookups → Lookup table files**
+2. Find `caca_settings.csv` in the CACA app
+3. Edit the `setting_value` column for any setting
+4. Save changes
+
+### Sample Data Generation (For Testing)
+
+CACA includes saved searches to generate sample data for testing and demonstration:
+
+1. **Generate Sample Registry**: Run `CACA - Generate Sample Registry` to populate the dashboard registry with 10 sample dashboards
+2. **Generate Sample Data**: Run `CACA - Generate Sample Data` to generate realistic metrics data
+
+**Note:** These searches are disabled by default. Enable and run them manually from **Settings → Searches, reports, and alerts** when you need test data. Disable them in production environments.
+
 ### Filtering Apps for Monitoring
 
 CACA can be configured to only monitor dashboards from specific apps, or exclude certain apps from monitoring. This is useful when you only want to track dashboards in production apps, or exclude system/admin apps.
@@ -583,6 +616,35 @@ We welcome contributions for any of these roadmap items or new feature ideas. Pl
 
 ## Release Notes
 
+### Version 1.0.0 (Comprehensive Rewrite)
+
+#### New Features
+- **Configurable Settings Lookup**: All thresholds (error levels, load times, stale detection, engagement scoring) are now configurable via `lookups/caca_settings.csv`
+- **Sample Data Generation**: New saved searches to generate test data for demonstration and testing purposes
+- **Enhanced Macros**: 25+ reusable search macros including:
+  - Settings loading and retrieval macros
+  - Stale and ghost dashboard detection
+  - Engagement scoring and VIP dashboard identification
+  - Customizable time range queries
+  - System app filtering
+- **New Collectors**:
+  - User engagement collector (tracks unique users per dashboard)
+  - Registry cleanup job (removes orphaned entries weekly)
+- **Alerting**: Pre-built alerts for critical dashboards and slow performance
+- **Reports**: Daily activity summary and weekly trend reports
+
+#### Improvements
+- Fixed all dashboard URL references to use correct app ID (`caca`)
+- Improved indexes.conf with metric-specific optimizations
+- Better error handling in all collectors
+- More robust field extraction in data collection
+- Improved performance with tsidx reduction enabled
+- Core data collection searches enabled by default (alerts and reports disabled by default)
+
+#### Breaking Changes
+- App version bumped from 0.0.1 to 1.0.0
+- Some macro names have been updated for consistency
+
 ### Version 0.0.1
 - Initial draft
 

app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null,
       "name": "caca",
-      "version": "0.0.1"
+      "version": "1.0.0"
     },
     "author": [
       {
@@ -15,11 +15,11 @@
       }
     ],
     "releaseDate": null,
-    "description": "CACA (Content Activity Checking Application) - Track usage, health, and lifecycle of your Splunk dashboards",
+    "description": "CACA (Content Activity Checking Application) - Monitor dashboard usage, health, performance, and lifecycle. Track views, edits, errors, and load times to identify high-value content, stale dashboards, and performance issues.",
     "classification": {
       "intendedAudience": "IT",
       "categories": ["IT Operations", "Monitoring"],
-      "developmentStatus": "Beta/Draft"
+      "developmentStatus": "Production"
     },
     "commonInformationModels": null,
     "license": {

default/app.conf

@@ -1,14 +1,15 @@
 [install]
-is_configured = 0
+is_configured = 1
+build = 1
 
 [ui]
 is_visible = 1
 label = CACA - Content Activity Checking Application
 
 [launcher]
 author = Devin Slick
-description = CACA (Content Activity Checking Application) - Track usage, health, and lifecycle of your Splunk dashboards
-version = 0.0.1
+description = CACA (Content Activity Checking Application) - Monitor dashboard usage, health, performance, and lifecycle. Track views, edits, errors, and load times to identify high-value content, stale dashboards, and performance issues.
+version = 1.0.0
 
 [package]
 id = caca

default/data/ui/views/caca_admin.xml

@@ -392,7 +392,7 @@
             <link target="_blank">$row.Dashboard URI$</link>
           </condition>
           <condition field="*">
-            <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard Name$</link>
+            <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard Name$</link>
           </condition>
         </drilldown>
       </table>
@@ -415,7 +415,7 @@
             <a href="/manager/caca/apps/local" target="_blank" class="btn btn-secondary" style="min-width: 200px; text-align: center; padding: 12px 20px;">
               ⚙️ Settings
             </a>
-            <a href="/en-US/app/splunk-content-monitoring-console/search" target="_blank" class="btn btn-secondary" style="min-width: 200px; text-align: center; padding: 12px 20px;">
+            <a href="/app/caca/search" target="_blank" class="btn btn-secondary" style="min-width: 200px; text-align: center; padding: 12px 20px;">
               🔍 Search
             </a>
           </div>
@@ -532,7 +532,7 @@
           <option name="precision">0</option>
         </format>
         <drilldown>
-          <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard Name$</link>
+          <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard Name$</link>
         </drilldown>
       </table>
     </panel>
@@ -543,8 +543,8 @@
     <panel>
       <html>
         <div style="text-align: center; padding: 20px;">
-          <a href="/app/splunk-content-monitoring-console/dashboard_leaderboard" class="btn btn-primary" style="margin: 5px;">← Back to Dashboard Leaderboard</a>
-          <a href="/app/splunk-content-monitoring-console/poop_deck" class="btn btn-secondary" style="margin: 5px;">View Poop Deck Analysis</a>
+          <a href="/app/caca/dashboard_leaderboard" class="btn btn-primary" style="margin: 5px;">← Back to Dashboard Leaderboard</a>
+          <a href="/app/caca/poop_deck" class="btn btn-secondary" style="margin: 5px;">View Poop Deck Analysis</a>
         </div>
       </html>
     </panel>

default/data/ui/views/dashboard_details.xml

@@ -227,7 +227,7 @@
   <row>
     <panel>
       <html>
-        <a href="/app/splunk-content-monitoring-console/dashboard_leaderboard" class="btn btn-primary">← Back to Dashboard Leaderboard</a>
+        <a href="/app/caca/dashboard_leaderboard" class="btn btn-primary">← Back to Dashboard Leaderboard</a>
       </html>
     </panel>
   </row>

default/data/ui/views/dashboard_leaderboard.xml

@@ -171,7 +171,7 @@
           <option name="precision">0</option>
         </format>
         <drilldown>
-          <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard Name$</link>
+          <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard Name$</link>
         </drilldown>
       </table>
     </panel>
@@ -264,7 +264,7 @@
           <option name="precision">0</option>
         </format>
         <drilldown>
-          <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
+          <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
         </drilldown>
       </table>
     </panel>

default/data/ui/views/poop_deck.xml

@@ -168,7 +168,7 @@
           <option name="precision">0</option>
         </format>
         <drilldown>
-          <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
+          <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
         </drilldown>
       </table>
     </panel>
@@ -215,7 +215,7 @@
           <option name="precision">0</option>
         </format>
         <drilldown>
-          <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
+          <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
         </drilldown>
       </table>
     </panel>
@@ -273,7 +273,7 @@
           <option name="precision">0</option>
         </format>
         <drilldown>
-          <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
+          <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
         </drilldown>
       </table>
     </panel>
@@ -329,7 +329,7 @@
           <option name="precision">0</option>
         </format>
         <drilldown>
-          <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
+          <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
         </drilldown>
       </table>
     </panel>
@@ -382,7 +382,7 @@
           <option name="precision">0</option>
         </format>
         <drilldown>
-          <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
+          <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
         </drilldown>
       </table>
     </panel>
@@ -434,7 +434,7 @@
           <option name="precision">2</option>
         </format>
         <drilldown>
-          <link target="_blank">/app/splunk-content-monitoring-console/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
+          <link target="_blank">/app/caca/dashboard_details?form.dashboard_name=$row.Dashboard$</link>
         </drilldown>
       </table>
     </panel>
@@ -445,8 +445,8 @@
     <panel>
       <html>
         <div style="text-align: center; padding: 20px;">
-          <a href="/app/splunk-content-monitoring-console/dashboard_leaderboard" class="btn btn-primary" style="margin: 5px;">← Back to Dashboard Leaderboard</a>
-          <a href="/app/splunk-content-monitoring-console/search" class="btn btn-secondary" style="margin: 5px;">Open in Search</a>
+          <a href="/app/caca/dashboard_leaderboard" class="btn btn-primary" style="margin: 5px;">← Back to Dashboard Leaderboard</a>
+          <a href="/app/caca/search" class="btn btn-secondary" style="margin: 5px;">Open in Search</a>
         </div>
         <div style="text-align: center; padding: 10px; color: #708794; font-style: italic;">
           <p>💡 Pro Tip: Use the stale threshold dropdown to adjust what counts as "crap" in your environment.</p>

default/indexes.conf

@@ -1,8 +1,24 @@
-# Metrics index for dashboard monitoring data
+# Metrics index for CACA - Content Activity Checking Application
+# This index stores all dashboard usage, health, and performance metrics
+
 [caca_metrics]
 datatype = metric
-homePath   = $SPLUNK_DB/caca_metrics/db
-coldPath   = $SPLUNK_DB/caca_metrics/colddb
+homePath = $SPLUNK_DB/caca_metrics/db
+coldPath = $SPLUNK_DB/caca_metrics/colddb
 thawedPath = $SPLUNK_DB/caca_metrics/thaweddb
-# Retain metrics for 1 year by default
+
+# Retain metrics for 1 year (365 days) by default
+# Adjust based on your retention requirements
 frozenTimePeriodInSecs = 31536000
+
+# Bucket management settings
+maxWarmDBCount = 300
+
+# Enable tsidx reduction for better metric performance
+enableTsidxReduction = true
+tsidxReductionCheckPeriodInSec = 600
+
+# Metric-specific optimizations
+# These settings help with high-cardinality metrics
+metric.timestampResolution = s
+metric.maxHotBuckets = 10