topic Re: List all the dashboards using specific metrics index in Splunk Enterprise

List all the dashboards using specific metrics index

BEN_ — Tue, 05 Dec 2023 14:41:25 GMT

I would like to find a way to list the dependency between dashboards and indexes.

I'm using the following query to get the list of all the Dashboards using the index Oracle which is an event Index.

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" | search "eai:data"="*index=oracle*" | eval Type="Dashboards" | table Type title eai:acl.app author eai:acl.perms.read

This query is working fine but not for Metrics index.

Am I missing something ?

Re: List all the dashboards using specific metrics index

bowesmana — Tue, 05 Dec 2023 23:00:28 GMT

Your search= statement is simply looking for that index=oracle somewhere in the dashboard. If you have index="oracle" or index = oracle then it won't match, so it may be better to do a regex where clause, where you do

... | where match('eai:data', "(?i)index\s*(=[\s\"]*|in\s+\([\w,]*)oracle")

what is an example of a metrics index search that is not showing up?

Re: List all the dashboards using specific metrics index

BEN_ — Tue, 12 Dec 2023 16:39:47 GMT

Thank you for your response. I'm using explicitly the index="oracle" as an example to confirm when the search works fine for an index event. When I use the same search for Metrics index (replacing index="oracle" by index="murex_metrics") it doesn't work knowing that we have existent dashboards using this metrics index.

here the example of a metrics index search

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" | search "eai:data"="*index=murex_metrics*"

thanks

Re: List all the dashboards using specific metrics index

bowesmana — Wed, 13 Dec 2023 21:24:44 GMT

There is no good reason why it would not find it if it is present. You should be able to figure out the issue by just finding a single dashboard you know has that expression and running this

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" | search title="xyz" | eval match=if(match('eai:data', "(?i)index=murex_metrics", 1, 0) | table match eai:data

replace xyz with your dashboard title and then you will have two columns match and eai:data - match will be 1 or 0 depending if found and you should be able to do a visual check on the data

Re: List all the dashboards using specific metrics index

BEN_ — Thu, 14 Dec 2023 10:55:37 GMT

Hi bowesmana,

Yes you are right. The query is working fine for both event and Metrics indexes. the problem was at level of the search filter.

I found that the search in the dashboard contains "" {... WHERE "index"="murex_metrics" AND ... } this explains why the filter in my search "eai:data"="*index=murex_metrics*" didn't return any data.

Thanks again

Re: List all the dashboards using specific metrics index

VatsalJagani — Thu, 14 Dec 2023 12:17:09 GMT

@BEN_ - While this covers much of what you are trying to find. It's important to keep in mind that this would not cover all the scenarios. Some example queries would not be covered by the query.

index IN (murex_metrics)
index=*
index=murex*
etc