splunk-security_content/dist/devsecops/default/data/ui/views/user_analytics.xml

        <dashboard version="2" theme="dark">
            <label>User Analytics</label>
            <description></description>
            <definition><![CDATA[{"visualizations":{"viz_HBndDcC8":{"type":"viz.rectangle","options":{"rx":4,"stroke":"transparent","fill":"#08080A","fillOpacity":0.7}},"viz_vPNP9DGA":{"type":"viz.text","options":{"content":"User Analytics","textColor":"#ffffff","fontWeight":"bold","fontFamily":"Splunk Platform Sans","fontSize":30}},"viz_trxVvFuq":{"type":"viz.table","options":{"headerTextColor":"#ffffff","rowTextColorOdd":"#ffffff","rowTextColorEven":"#ffffff","backgroundColor":"transparent","headerBackgroundColor":"#0E6162","rowBackgroundColorEven":"#08090A","rowBackgroundColorOdd":"transparent"},"dataSources":{"primary":"ds_dzifVa29_ds_LIRVs8HJ"},"title":""},"viz_XpNIREXZ":{"type":"viz.rectangle","options":{"fill":"#08080A","stroke":"#6AD6D7","strokeWidth":4,"rx":4,"fillOpacity":0.7}},"viz_dqiBE1n6":{"type":"viz.text","options":{"content":"Total Alerts","textColor":"#ffffff","fontSize":16,"fontFamily":"Splunk Platform Sans"}},"viz_HJSvzC9V":{"type":"splunk.singlevalue","dataSources":{"primary":"ds_42O6TeFY_ds_kYoaiRUv_ds_Ui7HgXoq"},"encoding":{"majorColor":{"field":"primary[0]","format":{"type":"rangevalue","ranges":[{"from":50,"value":"#D6867E"},{"to":50,"value":"#5fbcff"}]}}},"title":"","options":{"backgroundColor":"transparent"}},"viz_SFmd93VH":{"type":"viz.text","options":{"content":"Signals","textColor":"#ffffff","fontWeight":"bold","fontFamily":"Splunk Platform Sans","fontSize":30}},"viz_IHs7L0T4":{"type":"viz.rectangle","options":{"rx":4,"stroke":"transparent","fill":"#08080A","fillOpacity":0.7}},"viz_kLinhZzt":{"type":"viz.text","options":{"content":"Historical Alerts last 30 days","textColor":"#ffffff","fontSize":16,"fontFamily":"Splunk Platform Sans"}},"viz_LMIiUGeq":{"type":"viz.area","options":{"backgroundColor":"transparent","areaFillOpacity":0.4,"foregroundColor":"#cccccc","fontColor":"#cccccc","axisTitleX.visibility":"collapsed","axisTitleY.visibility":"collapsed","axisLabelsX.majorLabelVisibility":"hide","axisLabelsY.majorLabelVisibility":"hide","gridLinesX.showMajorLines":false,"gridLinesY.showMajorLines":false,"seriesColors":"[#EC4B43]","legend.placement":"none"},"dataSources":{"primary":"ds_Ass1Td1P"}},"viz_rT4MNLgP":{"type":"viz.markergauge","options":{"orientation":"horizontal","backgroundColor":"#212527","ranges":[{"from":130,"value":"#dc4e41","to":200},{"from":60,"value":"#f8be34","to":130},{"from":0,"to":60,"value":"#4BEBA8"}]},"dataSources":{"primary":"ds_CHraIgca"}},"viz_YAw20vcW":{"type":"viz.text","options":{"content":"Risk Level","textColor":"#ffffff","fontSize":16,"fontFamily":"Splunk Platform Sans"}},"viz_6R11LGlF":{"type":"viz.rectangle","options":{"fill":"#08080A","stroke":"#6AD6D7","strokeWidth":4,"rx":4,"fillOpacity":0.7}},"viz_W0DxWNZP":{"type":"viz.table","options":{"headerTextColor":"#ffffff","rowTextColorOdd":"#ffffff","rowTextColorEven":"#ffffff","backgroundColor":"transparent","headerBackgroundColor":"#0E6162","rowBackgroundColorEven":"#08090A","rowBackgroundColorOdd":"transparent"},"dataSources":{"primary":"ds_LIRVs8HJ"},"title":""},"viz_AnwYjIMJ":{"type":"viz.text","options":{"content":"Alerts","textColor":"#ffffff","fontWeight":"bold","fontFamily":"Splunk Platform Sans","fontSize":30}}},"dataSources":{"ds_sHUvoDKE_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=alerts OR index=signals | stats dc(user)"},"name":"Triage Time"},"ds_JhEHlFy5_ds_sHUvoDKE_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=alerts OR index=signals | stats dc(host)"},"name":"Admission Time"},"ds_4pBgG928_ds_JhEHlFy5_ds_sHUvoDKE_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"| makeresults\n| eval Value=\"18\""},"name":"Evaluation Time"},"ds_LIRVs8HJ":{"type":"ds.search","options":{"query":"index=alerts user=$token_user$ | fillnull | rename source as rule | stats count by rule user risk_score | sort - count "},"name":"Diagnostic Imaging"},"ds_lyCjku4B":{"type":"ds.search","options":{"queryParameters":{"earliest":"-7d@d","latest":"now"},"query":"index=alerts | fillnull | rename source as rule | stats sum(risk_score) as \"risk score\" values(rule) as rules by user | sort - \"risk score\""},"name":"Clinical Exam"},"ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=signals user=$token_user$\n| stats count"},"name":"Average Wait Time"},"ds_0Rt99YYY":{"type":"ds.search","options":{"queryParameters":{"earliest":"-7d@d","latest":"now"},"query":"index=alerts \n| stats dc(user)"},"name":"Search_1"},"ds_Ixiq9nvV_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=* \n| stats count"},"name":"Average Discharge"},"ds_V0OUeNEF_ds_0Rt99YYY":{"type":"ds.search","options":{"queryParameters":{"earliest":"-7d@d","latest":"now"},"query":"index=alerts\n| stats dc(host)"},"name":"Copy of Search_1"},"ds_hPbh0anu_ds_V0OUeNEF_ds_0Rt99YYY":{"type":"ds.search","options":{"queryParameters":{"earliest":"-7d@d","latest":"now"},"query":"index=alerts \n| stats dc(source)"},"name":"Copy of Copy of Search_1"},"ds_42O6TeFY_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=alerts user=$token_user$\n| stats count"},"name":"Copy of Average Wait Time"},"ds_8wGK1wf6_ds_42O6TeFY_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=incidents \n| stats count"},"name":"Copy of Copy of Average Wait Time"},"ds_52kqP7no":{"type":"ds.search","options":{"queryParameters":{"earliest":"-7d@d","latest":"now"},"query":"| makeresults \n| eval value=\"36\" \n| table value"},"name":"Gauge"},"ds_fN8spe8s_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=signals\n| stats count"},"name":"Copy of Average Wait Time"},"ds_rE6Du7O0_ds_JhEHlFy5_ds_sHUvoDKE_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=* \n|  stats count"},"name":"Copy of Admission Time"},"ds_8Ysd2heB_ds_fN8spe8s_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=alerts \n| stats count"},"name":"Copy of Copy of Average Wait Time"},"ds_dzifVa29_ds_LIRVs8HJ":{"type":"ds.search","options":{"query":"index=signals user=$token_user$ | fillnull | rename source as rule | stats count by rule user risk_score | sort - count"},"name":"Copy of Diagnostic Imaging"},"ds_Ass1Td1P":{"type":"ds.search","options":{"queryParameters":{"earliest":"-30d@d","latest":"now"},"query":"index=alerts user=$token_user$\n|  timechart count"},"name":"Search_2"},"ds_CHraIgca":{"type":"ds.search","options":{"queryParameters":{"earliest":"-7d@d","latest":"now"},"query":"index=alerts user=$token_user$\n| dedup source user repository\n| stats sum(risk_score) as total_risk_score"},"name":"Search_3"},"ds_BqxUpV09_ds_LIRVs8HJ":{"type":"ds.search","options":{"query":"index=signals user=$token_user$ | fillnull | rename source as rule | stats count by rule user risk_score | sort - count "},"name":"Copy of Diagnostic Imaging"}},"inputs":{"input_OtPymaGy":{"options":{"defaultValue":"P4T12ICK","token":"token_user"},"title":"User","type":"input.text"}},"layout":{"type":"absolute","options":{"width":1920,"display":"auto-scale","backgroundColor":"#111215","backgroundImage":{"src":"/en-US/static/app/splunk-dashboard-app/images/examples-hub/healthcare_dashboard/Background.png","x":0,"y":0,"sizeType":"contain"},"height":1080},"structure":[{"item":"viz_XpNIREXZ","type":"block","position":{"x":30,"y":350,"w":960,"h":690}},{"item":"viz_HBndDcC8","type":"block","position":{"x":30,"y":100,"w":300,"h":150}},{"item":"viz_vPNP9DGA","type":"block","position":{"x":30,"y":30,"w":680,"h":60}},{"item":"viz_trxVvFuq","type":"block","position":{"x":40,"y":360,"w":940,"h":670}},{"item":"viz_dqiBE1n6","type":"block","position":{"x":50,"y":100,"w":220,"h":50}},{"item":"viz_HJSvzC9V","type":"block","position":{"x":90,"y":140,"w":170,"h":100}},{"item":"viz_SFmd93VH","type":"block","position":{"x":40,"y":280,"w":800,"h":60}},{"item":"viz_IHs7L0T4","type":"block","position":{"x":1020,"y":100,"w":860,"h":150}},{"item":"viz_kLinhZzt","type":"block","position":{"x":1030,"y":100,"w":220,"h":50}},{"item":"viz_LMIiUGeq","type":"block","position":{"x":1020,"y":100,"w":860,"h":150}},{"item":"viz_rT4MNLgP","type":"block","position":{"x":360,"y":100,"w":630,"h":150}},{"item":"viz_YAw20vcW","type":"block","position":{"x":380,"y":100,"w":220,"h":50}},{"item":"viz_6R11LGlF","type":"block","position":{"x":1020,"y":350,"w":890,"h":690}},{"item":"viz_W0DxWNZP","type":"block","position":{"x":1030,"y":360,"w":860,"h":670}},{"item":"viz_AnwYjIMJ","type":"block","position":{"x":1030,"y":280,"w":800,"h":60}}],"globalInputs":["input_OtPymaGy"]},"defaults":{"visualizations":{"global":{"showLastUpdated":false}}},"description":"","title":"User Analytics"}]]></definition>
            <assets><![CDATA[{}]]></assets>
        </dashboard>