Adding and Creating Your Own Custom Workbooks for LogShark

Add Your Own Custom Workbooks

LogShark provides an option to include your own custom workbooks in a LogShark run.  These workbooks will then be included in the run output if the CustomWorkbooks plugin is run and all of their dependencies are met.

1. To configure this, first browse to your LogShark installation directory and open up the CustomWorkbooks folder.  
2. Add your custom workbook (.twbx) files to this folder.  

3. Additionally, you will need to edit CustomWorkbookConfig.xml file and add an Workbook entry for each custom workbook. The required attributes and elements are the names of the workbooks and any dependencies they have on other workbooks.

   For example:

<!--
  Custom Tableau workbooks can be placed alongside this config and they will be output at runtime if their dependencies are met.
  Plugin dependencies must be declared for any plugins that generate a table that the custom workbook relies on.
  To get a list of eligible plugin dependency names, invoke LogShark with the "listplugins" command line flag.
-->
<CustomWorkbooks>
  <!-- EXAMPLE
  <Workbook name="MyCustomWorkbook.twbx">
    <PluginDependency name="Apache" />
    <PluginDependency name="Backgrounder" />
  </Workbook>
  -->

  <Workbook name="MyCustomApacheAndBackgrounderWorkbook.twbx">
    <PluginDependency name="Apache" />
    <PluginDependency name="Backgrounder" />
  </Workbook>

</CustomWorkbooks>

This entry will cause the file MyCustomApacheAndBackgrounderWorkbook.twbx to be output at the LogShark run with the appropriate data sources substituted.  NOTE: The PluginDependency entries in the example above will make it so that the workbook will only be output if both the Apache and Backgrounder plugins run successfully.  You can declare multiple plugin dependencies for a single workbook, so that you can include workbooks that join the output tables of multiple plugins.

Creating Your Own Custom Workbooks from LogShark Data

Currently, there isn’t a customer facing data dictionary for Tableau logs since it is very difficult to keep it current and up to date from version to version as the log formats change. In the absence of such a dictionary, your best option would be to break apart some of the existing workbooks generated by LogShark and exploring the fields within it to determine what data is available to answer your questions. Outlined below is one suggestion on how you can achieve this:

1. Download Fiddler and launch it
2. In Fiddler, configure it to Decrypt HTTPS traffic i.e. if SSL is enabled on your Tableau installation
3. Launch Tableau Desktop or for Tableau Server, open your favorite browser, and perform any specific operation(s)
4. View the traffic in Fiddler to determine the endpoints that were hit when performing that specific operation(s). Use this information, to find the corresponding request in the Apache httpd logs. (For Server File log locations see: https://onlinehelp.tableau.com/current/server/en-us/logs_loc.htm, for working with log files see: https://onlinehelp.tableau.com/current/server/en-us/logs_working_with.htm).
5. Use the Session ID to trace and search this request across all the logs. Check to see if this answers your question for that individual request and make a note of all the logs that had information about your request.
6. If so, run LogShark, start with the Apache workbook and filter down to your specific request. Explore the data fields related to your request ID and see if you can build a view to answer the same question with the LogShark data.