Add a Domain policy dropdown filter to the Splunk aggregate dashboard (#854) (#855)

Adds a dropdown that filters every panel on the published DMARC policy
(published_policy.p) or subdomain policy (published_policy.sp), mirroring
the Message disposition dropdown's choices and default and sitting
immediately before it, per the issue spec. Both fields are always present
on parsedmarc-written events (sp defaults to p in the parser), so the
wildcard default matches everything, consistent with the other raw-search
filters.

Also fixes the Splunk docs page's XML-files link, which still pointed at
the pre-#736 splunk/ path and 404ed.

Closes #854

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Sean Whalen
2026-07-25 20:48:44 -04:00
committed by GitHub
co-authored by Claude Fable 5
parent b02a7972b5
commit a421747a79
3 changed files with 12 additions and 2 deletions
+1 -1
View File
@@ -18,5 +18,5 @@ The Splunk dashboards display the same content and layout as the
Kibana dashboards, although the Kibana dashboards have slightly
easier and more flexible filtering options.
[xml files]: https://github.com/domainaware/parsedmarc/tree/master/splunk
[xml files]: https://github.com/domainaware/parsedmarc/tree/master/dashboards/splunk
[http event collector (hec)]: http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC