Adding and Creating Your Own Custom Workbooks for LogShark

Add Your Own Custom Workbooks

LogShark can include your own .twbx workbook templates in a run’s output, alongside the built-in plugin workbooks.

1. In LogSharkConfig.json (in the Config directory of your LogShark installation), set EnvironmentConfig.CustomWorkbookTemplatesDir to the path of a folder containing your custom workbook templates.

   For example:

"EnvironmentConfig": {
    "CustomWorkbookTemplatesDir": "C:\\LogShark\\CustomWorkbooks"
}

1. Add your custom workbook (.twbx) files to that folder.

At run time, LogShark scans this folder (in addition to the built-in Workbooks folder) for .twbx files. There is no separate CustomWorkbooks plugin and no CustomWorkbookConfig.xml — LogShark determines dependencies directly from the .hyper data source extracts packaged inside each .twbx file, instead of a declared list of plugin names.

• A custom workbook is only produced in the run output if every .hyper extract it references was actually generated during that run (i.e. the plugin(s) that produce those data sets ran and generated data). There’s no separate dependency list to maintain — the dependency is simply whichever data source(s) you build the workbook against in Tableau Desktop.
• To find valid extract/data source names to build your workbook against, open one of the built-in workbooks in <LogShark_install_location>\Workbooks (for example Apache.twbx) in Tableau Desktop and inspect its data source names — these correspond to the .hyper extracts LogShark’s plugins generate.
• Custom workbook output filenames are prefixed with Custom\ to distinguish them from the built-in workbooks.

Note: the --workbookname <suffix> command line option (and the EnvironmentConfig.AppendLogsetNameToOutput config setting) appends a suffix to the filenames of all generated workbooks, both built-in and custom — it is not specific to custom workbooks.

Creating Your Own Custom Workbooks from LogShark Data

Currently, there isn’t a customer facing data dictionary for Tableau logs since it is very difficult to keep it current and up to date from version to version as the log formats change. In the absence of such a dictionary, your best option would be to break apart some of the existing workbooks generated by LogShark and exploring the fields within it to determine what data is available to answer your questions. Outlined below is one suggestion on how you can achieve this:

1. Download Fiddler and launch it
2. In Fiddler, configure it to Decrypt HTTPS traffic i.e. if SSL is enabled on your Tableau installation
3. Launch Tableau Desktop or for Tableau Server, open your favorite browser, and perform any specific operation(s)
4. View the traffic in Fiddler to determine the endpoints that were hit when performing that specific operation(s). Use this information, to find the corresponding request in the Apache httpd logs. (For Server File log locations see: https://onlinehelp.tableau.com/current/server/en-us/logs_loc.htm, for working with log files see: https://onlinehelp.tableau.com/current/server/en-us/logs_working_with.htm).
5. Use the Session ID to trace and search this request across all the logs. Check to see if this answers your question for that individual request and make a note of all the logs that had information about your request.
6. If so, run LogShark, start with the Apache workbook and filter down to your specific request. Explore the data fields related to your request ID and see if you can build a view to answer the same question with the LogShark data.