From 4d62cd1c3e6d1ac698451d06c43b4540408ba836 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 19 Jun 2026 07:42:59 +0000
Subject: [PATCH] Add Buttercup Operations Dashboard for SA-S4R workshop

Ship a Dashboard Studio view with five team panels (IT Ops, DevOps,
Business Analytics, Security & Fraud) using canonical SPL from the S4R
catalog. Default time range is the last hour with one-minute refresh.

Also add platform field extraction for DevOps panels, nav entry, view
ACL metadata, and an MCP validation script (make validate-s4r-dashboard).

Co-authored-by: D. Dessy (Splunk) <ddessy@splunk.com>
---
 Makefile                                      |   3 +
 SA-S4R/default/data/ui/nav/default.xml        |   3 +-
 .../views/buttercup_operations_dashboard.xml  | 303 ++++++++++++++++++
 SA-S4R/default/props.conf                     |   1 +
 SA-S4R/metadata/default.meta                  |   4 +
 docs/S4R-DASHBOARD.md                         |   1 +
 scripts/validate-s4r-dashboard-queries.sh     |  87 +++++
 7 files changed, 401 insertions(+), 1 deletion(-)
 create mode 100644 SA-S4R/default/data/ui/views/buttercup_operations_dashboard.xml
 create mode 100755 scripts/validate-s4r-dashboard-queries.sh

diff --git a/Makefile b/Makefile
index d4b0487..e3d30fb 100644
--- a/Makefile
+++ b/Makefile
@@ -106,6 +106,9 @@ verify: ## Stack status then Splunk MCP client verify
 	@$(MAKE) status
 	@$(MAKE) verify-mcp-remote
 
+validate-s4r-dashboard: ## Validate Buttercup dashboard panel SPL via Splunk MCP
+	@./scripts/validate-s4r-dashboard-queries.sh
+
 s4r-attack-nk-enable: ## Enable NK purchase-attack Eventgen stanza (then: make restart)
 	@./scripts/toggle-s4r-attack-nk.sh enable
 
diff --git a/SA-S4R/default/data/ui/nav/default.xml b/SA-S4R/default/data/ui/nav/default.xml
index 2d955a3..16ef079 100644
--- a/SA-S4R/default/data/ui/nav/default.xml
+++ b/SA-S4R/default/data/ui/nav/default.xml
@@ -1,6 +1,7 @@
 <!-- Matches Splunk barebones app template ($SPLUNK_HOME/share/splunk/app_templates/barebones/...). -->
-<nav search_view="search" color="#1A1C24">
+<nav search_view="search" color="#791CF8">
   <view name="search" default="true" />
+  <view name="buttercup_operations_dashboard" />
   <view name="analytics_workspace" />
   <view name="datasets" />
   <view name="reports" />
diff --git a/SA-S4R/default/data/ui/views/buttercup_operations_dashboard.xml b/SA-S4R/default/data/ui/views/buttercup_operations_dashboard.xml
new file mode 100644
index 0000000..3627fb4
--- /dev/null
+++ b/SA-S4R/default/data/ui/views/buttercup_operations_dashboard.xml
@@ -0,0 +1,303 @@
+<dashboard version="2" theme="dark">
+  <label>Buttercup Enterprises — Operations Dashboard</label>
+  <description>Multi-team Dashboard Studio view for Buttercup Enterprises workshop data (SA-S4R). Global time range defaults to the last hour; searches refresh every minute.</description>
+  <definition><![CDATA[
+{
+  "title": "Buttercup Enterprises \u2014 Operations Dashboard",
+  "description": "Multi-team operations dashboard for IT Operations, DevOps, Business Analytics, and Security & Fraud. Panels 4 and 5 contain sensitive revenue and geographic data; restrict dashboard access via Splunk roles.",
+  "inputs": {
+    "input_global_trp": {
+      "type": "input.timerange",
+      "title": "Global Time Range",
+      "options": {
+        "token": "global_time",
+        "defaultValue": "-1h,now"
+      }
+    }
+  },
+  "defaults": {
+    "dataSources": {
+      "ds.search": {
+        "options": {
+          "queryParameters": {
+            "earliest": "$global_time.earliest$",
+            "latest": "$global_time.latest$"
+          },
+          "refresh": "1m",
+          "refreshType": "delay"
+        }
+      }
+    },
+    "visualizations": {
+      "global": {
+        "showProgressBar": true,
+        "showLastUpdated": true
+      }
+    }
+  },
+  "dataSources": {
+    "ds_itops_status": {
+      "type": "ds.search",
+      "name": "IT Ops status codes",
+      "options": {
+        "query": "index=main sourcetype=access_combined\n| timechart count by status limit=10"
+      }
+    },
+    "ds_devops_platform": {
+      "type": "ds.search",
+      "name": "DevOps top platforms",
+      "options": {
+        "query": "index=main sourcetype=access_combined\n| eval platform=if(isnull(platform),\"Other\",platform)\n| top limit=20 platform showperc=f"
+      }
+    },
+    "ds_devops_browser_failures": {
+      "type": "ds.search",
+      "name": "DevOps browser failures",
+      "options": {
+        "query": "index=main sourcetype=access_combined status>=400\n| timechart count by useragent limit=5 useother=f"
+      }
+    },
+    "ds_business_lost_revenue": {
+      "type": "ds.search",
+      "name": "Business lost revenue",
+      "options": {
+        "query": "index=main sourcetype=access_combined action=purchase status>=400\n| lookup product_codes.csv product_id\n| timechart sum(product_price)"
+      }
+    },
+    "ds_security_geo": {
+      "type": "ds.search",
+      "name": "Security geographic activity",
+      "options": {
+        "query": "index=main sourcetype=access_combined\n| iplocation clientip\n| geostats count by City"
+      }
+    }
+  },
+  "visualizations": {
+    "viz_itops_status": {
+      "type": "splunk.column",
+      "title": "IT Ops - Web Server Status Codes Over Time",
+      "description": "Successful vs unsuccessful web server requests over time.",
+      "dataSources": {
+        "primary": "ds_itops_status"
+      },
+      "options": {
+        "stackMode": "stacked",
+        "legendDisplay": "bottom",
+        "xAxisTitleText": "Time",
+        "yAxisTitleText": "Request count",
+        "backgroundColor": "transparent"
+      },
+      "containerOptions": {
+        "title": {
+          "color": "#FFFFFF"
+        },
+        "description": {
+          "color": "#E0E0E0"
+        }
+      }
+    },
+    "viz_devops_platform": {
+      "type": "splunk.bar",
+      "title": "DevOps - Top 20 Customer Platforms",
+      "description": "Most common customer operating systems and devices.",
+      "dataSources": {
+        "primary": "ds_devops_platform"
+      },
+      "options": {
+        "orientation": "horizontal",
+        "legendDisplay": "off",
+        "xAxisTitleText": "Count",
+        "yAxisTitleText": "Platform",
+        "backgroundColor": "transparent"
+      },
+      "containerOptions": {
+        "title": {
+          "color": "#FFFFFF"
+        },
+        "description": {
+          "color": "#E0E0E0"
+        }
+      }
+    },
+    "viz_devops_browser_failures": {
+      "type": "splunk.line",
+      "title": "DevOps - Browser Failures Over Time",
+      "description": "Web browsers experiencing the most HTTP 4xx/5xx failures.",
+      "dataSources": {
+        "primary": "ds_devops_browser_failures"
+      },
+      "options": {
+        "legendDisplay": "bottom",
+        "xAxisTitleText": "Time",
+        "yAxisTitleText": "Failure count",
+        "backgroundColor": "transparent"
+      },
+      "containerOptions": {
+        "title": {
+          "color": "#FFFFFF"
+        },
+        "description": {
+          "color": "#E0E0E0"
+        }
+      }
+    },
+    "viz_business_lost_revenue": {
+      "type": "splunk.area",
+      "title": "Business Analytics - Lost Revenue from Failed Purchases",
+      "description": "Financial impact of failed purchases over time (USD). Sensitive panel.",
+      "dataSources": {
+        "primary": "ds_business_lost_revenue"
+      },
+      "options": {
+        "legendDisplay": "off",
+        "xAxisTitleText": "Time",
+        "yAxisTitleText": "Lost revenue (USD)",
+        "backgroundColor": "transparent"
+      },
+      "containerOptions": {
+        "title": {
+          "color": "#FFFFFF"
+        },
+        "description": {
+          "color": "#E0E0E0"
+        }
+      }
+    },
+    "viz_security_geo": {
+      "type": "splunk.map",
+      "title": "Security & Fraud - Geographic Activity Heat Map",
+      "description": "City-level website activity to identify unusual geographic patterns. Sensitive panel.",
+      "dataSources": {
+        "primary": "ds_security_geo"
+      },
+      "options": {
+        "center": [
+          39.8283,
+          -98.5795
+        ],
+        "zoom": 3,
+        "backgroundColor": "transparent",
+        "showBaseLayer": true,
+        "baseLayerTileServer": "https://api.maptiler.com/maps/outdoor/{z}/{x}/{y}.png?key=NmOL38t5MnH6pNq8if7p",
+        "baseLayerTileServerType": "raster",
+        "layers": [
+          {
+            "type": "bubble",
+            "bubbleSize": "> primary | frameWithoutSeriesNames('geobin', 'latitude', 'longitude') | frameBySeriesTypes('number')",
+            "dataValues": "> primary | frameBySeriesTypes('number')"
+          }
+        ]
+      },
+      "context": {
+        "dataColorsEditorConfig": [
+          {
+            "to": 100,
+            "value": "#61CAFA"
+          },
+          {
+            "from": 100,
+            "to": 500,
+            "value": "#FAE75F"
+          },
+          {
+            "from": 500,
+            "value": "#EC4B43"
+          }
+        ]
+      },
+      "containerOptions": {
+        "title": {
+          "color": "#FFFFFF"
+        },
+        "description": {
+          "color": "#E0E0E0"
+        }
+      }
+    }
+  },
+  "layout": {
+    "options": {
+      "submitButton": false,
+      "showTitleAndDescription": true
+    },
+    "globalInputs": [
+      "input_global_trp"
+    ],
+    "tabs": {
+      "options": {
+        "showTabBar": false
+      },
+      "items": [
+        {
+          "label": "Operations",
+          "layoutId": "layout_main"
+        }
+      ]
+    },
+    "layoutDefinitions": {
+      "layout_main": {
+        "type": "absolute",
+        "options": {
+          "width": 1440,
+          "height": 1020,
+          "display": "auto-scale",
+          "backgroundColor": "#791CF8"
+        },
+        "structure": [
+          {
+            "type": "block",
+            "item": "viz_itops_status",
+            "position": {
+              "x": 20,
+              "y": 90,
+              "w": 690,
+              "h": 300
+            }
+          },
+          {
+            "type": "block",
+            "item": "viz_devops_platform",
+            "position": {
+              "x": 730,
+              "y": 90,
+              "w": 690,
+              "h": 300
+            }
+          },
+          {
+            "type": "block",
+            "item": "viz_devops_browser_failures",
+            "position": {
+              "x": 20,
+              "y": 410,
+              "w": 690,
+              "h": 280
+            }
+          },
+          {
+            "type": "block",
+            "item": "viz_business_lost_revenue",
+            "position": {
+              "x": 730,
+              "y": 410,
+              "w": 690,
+              "h": 280
+            }
+          },
+          {
+            "type": "block",
+            "item": "viz_security_geo",
+            "position": {
+              "x": 20,
+              "y": 710,
+              "w": 1400,
+              "h": 290
+            }
+          }
+        ]
+      }
+    }
+  }
+}
+  ]]></definition>
+</dashboard>
diff --git a/SA-S4R/default/props.conf b/SA-S4R/default/props.conf
index 974fc5e..173f95b 100644
--- a/SA-S4R/default/props.conf
+++ b/SA-S4R/default/props.conf
@@ -4,3 +4,4 @@ EXTRACT-action = action=(?<action>[^&\s"]+)
 EXTRACT-product_id = product_id=(?<product_id>[^&\s"]+)
 EXTRACT-uid = uid=(?<uid>[^&\s"]+)
 EXTRACT-JSESSIONID = JSESSIONID=(?<JSESSIONID>[^&\s"]+)
+EXTRACT-platform = \((?<platform>Linux; Android [0-9.]+|Macintosh; Intel Mac OS X [0-9_]+|Windows|iPhone; CPU iPhone OS [0-9_]+)
diff --git a/SA-S4R/metadata/default.meta b/SA-S4R/metadata/default.meta
index 350a382..c3913f7 100644
--- a/SA-S4R/metadata/default.meta
+++ b/SA-S4R/metadata/default.meta
@@ -16,3 +16,7 @@ export = system
 [lookup-table-files/product_codes.csv]
 access = read : [ * ], write : [ admin, sc_admin ]
 export = system
+
+[views/buttercup_operations_dashboard]
+access = read : [ admin, sc_admin, power, user ], write : [ admin, sc_admin ]
+export = none
diff --git a/docs/S4R-DASHBOARD.md b/docs/S4R-DASHBOARD.md
index 75804b8..fc428f8 100644
--- a/docs/S4R-DASHBOARD.md
+++ b/docs/S4R-DASHBOARD.md
@@ -106,6 +106,7 @@ Tasks:
 - Eventgen in this repo emits workshop-shaped traffic (~67% `/product.screen`, ~33% `/cart.do`) so panel ratios and errors should look plausible after a few minutes of ingestion.
 - **Workshop modes:** default data supports **infrastructure failure** (Lab 3–5). Optional **`make s4r-attack-nk-enable`** + **`make restart`** adds NK geo concentration for Lab 6 / “threat vs infrastructure” agent demos — see [SA-S4R-APP.md](SA-S4R-APP.md).
 - Prefer shipping dashboard JSON/XML under `SA-S4R/default/data/ui/views/` when automating; keep background reference as a dashboard asset path above.
+- Shipped dashboard: **`SA-S4R/default/data/ui/views/buttercup_operations_dashboard.xml`** (Dashboard Studio, indigo `#791CF8` background, last-hour default, 1m refresh). Validate panel SPL: **`make validate-s4r-dashboard`** (requires Splunk MCP).
 
 ## References
 
diff --git a/scripts/validate-s4r-dashboard-queries.sh b/scripts/validate-s4r-dashboard-queries.sh
new file mode 100755
index 0000000..de513fa
--- /dev/null
+++ b/scripts/validate-s4r-dashboard-queries.sh
@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Validate Buttercup Operations Dashboard panel SPL via Splunk MCP (splunk_run_query).
+# Requires Splunk up and secrets (.env or tpl.env + op run).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+EARLIEST="${S4R_DASHBOARD_EARLIEST:--1h}"
+LATEST="${S4R_DASHBOARD_LATEST:-now}"
+MAX_RESULTS="${S4R_DASHBOARD_MAX_RESULTS:-5}"
+ENDPOINT="${SPLUNK_MCP_ENDPOINT:-https://localhost:8089/services/mcp}"
+
+declare -a PANEL_NAMES=(
+  "IT Ops"
+  "DevOps platforms"
+  "DevOps browser failures"
+  "Business lost revenue"
+  "Security geo"
+)
+
+declare -a PANEL_QUERIES=(
+  'index=main sourcetype=access_combined | timechart count by status limit=10'
+  'index=main sourcetype=access_combined | eval platform=if(isnull(platform),"Other",platform) | top limit=20 platform showperc=f'
+  'index=main sourcetype=access_combined status>=400 | timechart count by useragent limit=5 useother=f'
+  'index=main sourcetype=access_combined action=purchase status>=400 | lookup product_codes.csv product_id | timechart sum(product_price)'
+  'index=main sourcetype=access_combined | iplocation clientip | geostats count by City'
+)
+
+command -v jq >/dev/null 2>&1 || { echo "jq required (brew install jq)" >&2; exit 1; }
+command -v curl >/dev/null 2>&1 || { echo "curl required" >&2; exit 1; }
+
+token="$(./scripts/mint-mcp-token.sh)" || {
+  echo "Could not mint MCP token. Is Splunk up?" >&2
+  exit 1
+}
+
+pass=0
+fail=0
+
+for i in "${!PANEL_NAMES[@]}"; do
+  name="${PANEL_NAMES[$i]}"
+  query="${PANEL_QUERIES[$i]}"
+  payload="$(jq -n \
+    --arg query "$query" \
+    --arg earliest "$EARLIEST" \
+    --arg latest "$LATEST" \
+    --argjson max_results "$MAX_RESULTS" \
+    '{
+      jsonrpc: "2.0",
+      id: 1,
+      method: "tools/call",
+      params: {
+        name: "splunk_run_query",
+        arguments: {
+          query: $query,
+          earliest: $earliest,
+          latest: $latest,
+          max_results: $max_results
+        }
+      }
+    }')"
+
+  echo "==> $name"
+  tmp="$(mktemp)"
+  # shellcheck disable=SC2329
+  cleanup() { rm -f "$tmp"; }
+  trap cleanup RETURN
+
+  if curl -kfsS -X POST "$ENDPOINT" \
+    -H "Authorization: Bearer ${token}" \
+    -H 'Content-Type: application/json' \
+    -H 'Accept: application/json' \
+    --data "$payload" >"$tmp" 2>&1 \
+    && jq -e '.result.content // .result' "$tmp" >/dev/null 2>&1; then
+    pass=$((pass + 1))
+    echo "OK"
+  else
+    fail=$((fail + 1))
+    echo "FAILED" >&2
+    cat "$tmp" >&2 || true
+  fi
+  trap - RETURN
+done
+
+echo "Validated $pass/${#PANEL_NAMES[@]} panel queries; $fail failure(s)."
+[[ "$fail" -eq 0 ]]