BB2-3970: Cleanup legacy splunk dashboards (#1377)

* BB2-3970: Cleanup legacy splunk dashboards

* Set form version = 1.1 for each dashboard that needed it

* Address PR feedback: Remove _legacy.xml files, remove _greenfield from current file and dashboard names

Author: JamesDemeryNava

splunk/api_big_stats_dashboard.xml

@@ -1,4 +1,4 @@
-<form>
+<form version="1.1">
   <label>BB2 DASG Metrics Dashboard</label>
   <description>Dashboard panels related to metrics for DASG reporting</description>
   <fieldset submitButton="false"></fieldset>
@@ -36,43 +36,43 @@
   <!-- Setup of BASE searches to be used in panels -->
   <search id="baseSearch1a">
     <!-- BASE search 1a. New Beneficiaries Added -->
-    <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" env=prod | spath "message.type" | search "message.type"="mymedicare_cb:create_beneficiary_record" | dedup message.fhir_id message.auth_client_id message.auth_uuid message.username | fields time message.auth_uuid message.fhir_id message.username message.auth_app_name message.mesg mesg message.user_mbi_hash message.user_hicn_hash message.auth_pkce_method message.status</query>
+    <query>index=application source="/bb/*/app/perf_mon.log" env=prod | spath "message.type" | search "message.type"="mymedicare_cb:create_beneficiary_record" | dedup message.fhir_id message.auth_client_id message.auth_uuid message.username | fields time message.auth_uuid message.fhir_id message.username message.auth_app_name message.mesg mesg message.user_mbi_hash message.user_hicn_hash message.auth_pkce_method message.status</query>
     <earliest>$t_local.earliest$</earliest>
     <latest>$t_local.latest$</latest>
     <sampleRatio>1</sampleRatio>
   </search>
   <search id="baseSearch1b">
     <!-- BASE search 1b. RETURNING Beneficiaries who have re-authorized -->
-    <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" env=prod | spath "message.type" | search "message.type"="mymedicare_cb:get_and_update_user" | search "message.mesg"="RETURN existing beneficiary record" | dedup message.fhir_id message.auth_client_id message.auth_uuid | fields time message.auth_uuid message.fhir_id message.auth_app_name message.mesg mesg message.user_mbi_hash message.user_hicn_hash message.auth_pkce_method message.status</query>
+    <query>index=application source="/bb/*/app/perf_mon.log" env=prod | spath "message.type" | search "message.type"="mymedicare_cb:get_and_update_user" | search "message.mesg"="RETURN existing beneficiary record" | dedup message.fhir_id message.auth_client_id message.auth_uuid | fields time message.auth_uuid message.fhir_id message.auth_app_name message.mesg mesg message.user_mbi_hash message.user_hicn_hash message.auth_pkce_method message.status</query>
     <earliest>$t_local.earliest$</earliest>
     <latest>$t_local.latest$</latest>
     <sampleRatio>1</sampleRatio>
   </search>
   <search id="baseSearch2">
     <!-- BASE search benes choosing to share demographics -->
-    <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" env=prod | spath "message.type" | search "message.type"="Authorization" | fields time message.auth_uuid message.auth_status message.message.application.name message.user.username message.user.crosswalk.fhir_id message.allow message.auth_share_demographic_scopes message.auth_require_demographic_scopes message.user.crosswalk.user_id_type message.auth_app_name message.user.crosswalk.user_mbi_hash message.user.crosswalk.user_hicn_hash message.auth_pkce_method message.scopes message.data_access_grant_delete_cnt message.access_token_delete_cnt message.refresh_token_delete_cnt message.auth_crosswalk_action message.user.crosswalk.fhir_id</query>
+    <query>index=application source="/bb/*/app/perf_mon.log" env=prod | spath "message.type" | search "message.type"="Authorization" | fields time message.auth_uuid message.auth_status message.message.application.name message.user.username message.user.crosswalk.fhir_id message.allow message.auth_share_demographic_scopes message.auth_require_demographic_scopes message.user.crosswalk.user_id_type message.auth_app_name message.user.crosswalk.user_mbi_hash message.user.crosswalk.user_hicn_hash message.auth_pkce_method message.scopes message.data_access_grant_delete_cnt message.access_token_delete_cnt message.refresh_token_delete_cnt message.auth_crosswalk_action message.user.crosswalk.fhir_id</query>
     <earliest>$t_local.earliest$</earliest>
     <latest>$t_local.latest$</latest>
     <sampleRatio>1</sampleRatio>
   </search>
   <search id="baseSearchFhirV1">
     <!-- BASE search for FHIR V1 events -->
-    <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" env=prod message.path="/v1/fhir/*" | fields time message.path message.response_code message.fhir_id</query>
+    <query>index=application source="/bb/*/app/perf_mon.log" env=prod message.path="/v1/fhir/*" | fields time message.path message.response_code message.fhir_id</query>
     <earliest>$t_local.earliest$</earliest>
     <latest>$t_local.latest$</latest>
     <sampleRatio>1</sampleRatio>
   </search>
   <search id="baseSearchFhirV2">
     <!-- BASE search for FHIR V2 events -->
-    <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" env=prod message.path="/v2/fhir/*" | fields time message.path message.response_code message.fhir_id</query>
+    <query>index=application source="/bb/*/app/perf_mon.log" env=prod message.path="/v2/fhir/*" | fields time message.path message.response_code message.fhir_id</query>
     <earliest>$t_local.earliest$</earliest>
     <latest>$t_local.latest$</latest>
     <sampleRatio>1</sampleRatio>
   </search>
 
   <!--<search id="baseSearchBeneCount">-->
     <!-- BASE search for FHIR V1 events -->
-  <!--  <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" host=* env=prod </query>-->
+  <!--  <query>index=application source="/bb/*/app/perf_mon.log" host=* env=prod </query>-->
   <!--  <earliest>$t_local.earliest$</earliest>-->
   <!--  <latest>$t_local.latest$</latest>-->
   <!--  <sampleRatio>1</sampleRatio>-->
@@ -114,13 +114,13 @@
         <done>
           <set token="tokGroupTimestamp">$result.message.group_timestamp$</set>
         </done>
-        <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" host=* env=prod | search "message.type"="global_state_metrics" | head 1 | table message.group_timestamp</query>
+        <query>index=application source="/bb/*/app/perf_mon.log" host=* env=prod | search "message.type"="global_state_metrics" | head 1 | table message.group_timestamp</query>
         <earliest>$t_local.earliest$</earliest>
         <latest>$t_local.latest$</latest>
       </search>
       <single>
         <search>
-          <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" host=* env=prod "message.type"="global_state_metrics" "message.group_timestamp"=$tokGroupTimestamp|s$ | table message.real_bene_cnt</query>
+          <query>index=application source="/bb/*/app/perf_mon.log" host=* env=prod "message.type"="global_state_metrics" "message.group_timestamp"=$tokGroupTimestamp|s$ | table message.real_bene_cnt</query>
           <earliest>$t_local.earliest$</earliest>
           <latest>$t_local.latest$</latest>
         </search>
@@ -196,7 +196,7 @@
             <set token="tokFhirV1PatientOKCount">$result.count$</set>
           </done>
            <!-- message.group_timestamp="2021-07-14T07:00:54+00:00" -->
-          <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" host=* env=prod | search "message.type"="global_state_metrics_per_app" "message.group_timestamp"=$tokGroupTimestamp|s$ message.active=True message.real_bene_cnt>25 | stats count</query>
+          <query>index=application source="/bb/*/app/perf_mon.log" host=* env=prod | search "message.type"="global_state_metrics_per_app" "message.group_timestamp"=$tokGroupTimestamp|s$ message.active=True message.real_bene_cnt>25 | stats count</query>
           <earliest>$t_local.earliest$</earliest>
           <latest>$t_local.latest$</latest>
         </search>
@@ -212,7 +212,7 @@
           <done>
             <set token="tokFhirV1PatientOKCount">$result.count$</set>
           </done>
-          <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" host=* env=prod | search "message.type"="global_state_metrics_per_app" "message.group_timestamp"=$tokGroupTimestamp|s$ message.active=True message.real_bene_cnt&lt;=25 | stats count</query>
+          <query>index=application source="/bb/*/app/perf_mon.log" host=* env=prod | search "message.type"="global_state_metrics_per_app" "message.group_timestamp"=$tokGroupTimestamp|s$ message.active=True message.real_bene_cnt&lt;=25 | stats count</query>
           <earliest>$t_local.earliest$</earliest>
           <latest>$t_local.latest$</latest>
         </search>
@@ -228,7 +228,7 @@
           <done>
             <set token="tokFhirV1PatientOKCount">$result.count$</set>
           </done>
-          <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" host=* env=prod | search "message.type"="global_state_metrics_per_app" "message.group_timestamp"=$tokGroupTimestamp|s$ message.active=True | stats count</query>
+          <query>index=application source="/bb/*/app/perf_mon.log" host=* env=prod | search "message.type"="global_state_metrics_per_app" "message.group_timestamp"=$tokGroupTimestamp|s$ message.active=True | stats count</query>
           <earliest>$t_local.earliest$</earliest>
           <latest>$t_local.latest$</latest>
         </search>
@@ -451,7 +451,7 @@
         <done>
           <set token="tokGroupTimestampSandbox">$result.message.group_timestamp$</set>
         </done>
-        <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" host=* env=impl | search "message.type"="global_state_metrics" | head 1 | table message.group_timestamp</query>
+        <query>index=application source="/bb/*/app/perf_mon.log" host=* env=impl | search "message.type"="global_state_metrics" | head 1 | table message.group_timestamp</query>
         <earliest>$t_local.earliest$</earliest>
         <latest>$t_local.latest$</latest>
       </search>
@@ -468,7 +468,7 @@
       <title>1. TOTAL Dev w/ SBX Cred + Registered App</title>
       <single>
         <search>
-          <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" host=* env=impl | search "message.type"="global_state_metrics" | head 1 | table message.global_apps_active_cnt</query>
+          <query>index=application source="/bb/*/app/perf_mon.log" host=* env=impl | search "message.type"="global_state_metrics" | head 1 | table message.global_apps_active_cnt</query>
         </search>
         <option name="drilldown">all</option>
         <option name="height">226</option>
@@ -480,7 +480,7 @@
       <title>2. TOTAL Dev w/ SBX Cred + Registered App + API Call</title>
       <single>
           <search>
-            <query>index=bluebutton source="/var/log/pyapps/perf_mon.log*" host=* env=impl | search "message.type"="global_state_metrics_per_app" | search "message.first_active"!="null" "message.group_timestamp"=$tokGroupTimestampSandbox|s$ | stats count</query>
+            <query>index=application source="/bb/*/app/perf_mon.log" host=* env=impl | search "message.type"="global_state_metrics_per_app" | search "message.first_active"!="null" "message.group_timestamp"=$tokGroupTimestampSandbox|s$ | stats count</query>
           </search>
         <option name="drilldown">all</option>
         <option name="height">226</option>