topic Used reports/dashboards in Monitoring Splunk

Used reports/dashboards

PickleRick — Mon, 25 Oct 2021 13:46:32 GMT

I was wondering...

Can I get (probably from _internal) which reports and dashboards were executed by users? I supposed that saved searches spawned by scheduler should be possible to either find in configuration (by checking their schedule) or by tracking scheduler logs. But ad-hoc ones?

Use case is - users created many different dashboards and reports and we want to clean the ones not used anymore. But first of course we need to find them.

Re: Used reports/dashboards

ashvinpandey — Mon, 25 Oct 2021 14:16:25 GMT

@PickleRick Please try the below query:

index="_internal" source=*access.log user!="-" */app/* | rex "\/en\-US\/app\/(?<app>\w+)\/(?<dashboard>\w+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home" dashboard!="alerts" dashboard!="alert" dashboard!="dashboards" dashboard!="reports" dashboard!="report" dashboard!="overview" | search dashboard="*" | bucket span=1m _time | stats count sparkline max(_time) as lastaccess earliest(_time) as StartTime by user | eval avg=count/5 | convert ctime(lastaccess) ctime(StartTime) | sort -lastaccess | rename user as "User" lastaccess as "Last accessed on" count as "No. of times accessed" avg as "Weekly Avg." StartTime as "First accessed on"

Also if this reply helped you an up vote will be appreciated

Re: Used reports/dashboards

PickleRick — Mon, 25 Oct 2021 14:42:54 GMT

After some fiddling (that's typical - I ask a question, then start looking for myself ;-)) it seems that I found a similar solution. I don't do the timecharting but just count but I approach it from a bit different side.

Instead of listing all URLs and only matching some of them. I firstly build a list of defined dashboards and then look for them in the access log.

index=_internal source="/opt/splunk/var/log/splunk/splunkd_ui_access.log" [| rest /services/data/ui/views | where isDashboard=1 | fields title | eval uri_path="/*/app/*/".title | table uri_path] | stats count by uri_path

But the general idea is similar. Thanks.

EDIT: Oh, and your search lists users, not the dashboards themselves. 😉

Re: Used reports/dashboards

somesoni2 — Mon, 25 Oct 2021 18:25:57 GMT

This app might be useful for what you're looking for (and some more):

https://splunkbase.splunk.com/app/3541/

Re: Used reports/dashboards

PickleRick — Mon, 25 Oct 2021 20:10:03 GMT

Hmm... Seems useful. Will have to give it a try. Thanks.