topic Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor? in Splunk Enterprise

Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor?

deepikagooty — Thu, 12 May 2022 17:41:14 GMT

Hi,

I would like to show the numbers of users and also the number of unique users visiting a particular dashboard. I want to display these numbers somewhere on the dashboard. I have multiple dashboards and would like to do the same for all the dashboards.

Is there an in-built feature/tool in Splunk that does this? or Is using JavaScript a better option for this?

Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor?

richgalloway — Thu, 12 May 2022 18:20:13 GMT

There is no built-in feature that does that. You'll have to search and parse the splunkd_ui_access log for that information.

Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor?

datsplunk4272 — Thu, 12 May 2022 18:48:24 GMT

Yes, @richgalloway is right!

As our Search Heads are configured with RSA authentication, I created and monitored a local index in Search Head to track the JSON file for each user in SPL.

$SPLUNK_HOME$/etc/app/<app_name(default: radius_auth>>local/user_info/<hash>.json

Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor?

deepikagooty — Thu, 12 May 2022 18:59:18 GMT

Could you please elaborate on this. Thank you.

Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor?

deepikagooty — Thu, 12 May 2022 19:02:37 GMT

Thanks for the reply @richgalloway The splunkd_ui_access log that I have only shows my activity. Is it because it is on my local machine? If this is deployed on to the production server, Will I be able to get information of all the users accessing that dashboard with the same splunkd_ui_access log file? Please let me know. Thank you.

Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor?

datsplunk4272 — Thu, 12 May 2022 19:47:40 GMT

Here is what I could have a summary:

1. Splunk authentication (I call local settings) and all local users' login/password are stored at $SPLUNK_HOME$/etc/passwd file. After users login, their profiles will be located $SPLUNK_HOME$/etc/users/ directory.

2. This is a way that I use to manage the users because I am using radius authentication as mentioned above. I listed the links to download and configure below that I followed so you could do your lab.

After completing the app installation and configuration, logging to SH > Click Settings > Add Data > Files & Directories ($SPLUNK_HOME$/etc/apps/radius_auth/local/user_info directory that will be monitored > follow the rest of the basic process.

Download app: https://splunkbase.splunk.com/app/981/

Configuration the radius access: https://lukemurphey.net/projects/splunk-radius-auth/wiki/Install_and_Configuration

(I could not show you my system snapshot because it is not the lab but if you have one, you could share it.)

Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor?

impurush — Thu, 12 May 2022 19:48:27 GMT

Hi, @deepikagooty,

You can use the below query to get the number of unique users who accessed the dashboard. You can embed this in your dashboard

index=_internal source=*splunkd_ui_access.log uri_path="*/<dashboard_url_name>" NOT user="-"
|stats dc(user)

Thanks,
Purush

User Monitoring for Splunk - https://splunkbase.splunk.com/app/5484/

Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor?

richgalloway — Thu, 12 May 2022 21:09:19 GMT

Since you are the only user (presumably) of your machine only your activity will be in the logs. In a shared environment, the logs will show the activity of all users.