topic Re: Find via search if rex is used in a dashboard search in Other Usage

How to find via search if rex is used in a dashboard search?

Marta — Thu, 03 Aug 2023 20:58:18 GMT

Hi,

I would like to know if it is possible to perform a search in Splunk to find out if "rex" is used in all my dashboard searches.

Kind regards

Marta

Re: Find via search if rex is used in a dashboard search

splunkreal — Thu, 03 Aug 2023 08:49:18 GMT

Hello @Marta

you could try this query :

| rest /servicesNS/-/-/data/ui/views
| rename eai:acl.app AS app
| rename eai:acl.perms.write as dashboard-write-permission
| rename eai:acl.perms.read as dashboard-read-permission
| rename eai:appName as appName
| rename eai:data AS data
| join type=outer appName
[| rest /servicesNS/-/-/apps/local
| rename title AS appName
| rename eai:acl.perms.read AS app-read-permission
| rename eai:acl.perms.write AS app-write-permission]
| table app label title dashboard-read-permission dashboard-read-permission app-write-permission app-read-permission data
| search data=*rex*

If this answers then please mark as solution.

Good luck.

Re: Find via search if rex is used in a dashboard search

Marta — Thu, 03 Aug 2023 10:27:09 GMT

Thank you for your answer. It worked. I have got one final question: how do I count the occurence of "rex" in the data column?

Kind regards

Marta

Re: Find via search if rex is used in a dashboard search

splunkreal — Thu, 03 Aug 2023 13:18:28 GMT

Maybe this :

Please upvote if this fits 🙂

Thanks.

Re: Find via search if rex is used in a dashboard search

Marta — Thu, 03 Aug 2023 13:38:32 GMT

thank you it worked 🙂 . How do I upvote? I pressed the karma button, is this the way to upvote?

Re: Find via search if rex is used in a dashboard search

splunkreal — Thu, 03 Aug 2023 14:02:23 GMT

Yes, that's perfect! Happy splunking 🙂