topic Re: How do I find which specific Data Sources are lighting up the different Dashboards? in Dashboards & Visualizations

How do I find which specific Data Sources are lighting up the different Dashboards?

miajay1980 — Thu, 25 Feb 2016 20:55:00 GMT

Is there any easy way to see which Data Source lights up specific Dashboards? I am creating documentation, and would like to include the data sources lighting up the different Dashboards.

Re: How do I find which specific Data Sources are lighting up the different Dashboards?

ppablo — Thu, 25 Feb 2016 21:20:23 GMT

Hi @miajay1980

Can you clarify what you mean by "lighting up" dashboards? Do you mean populating dashboards with data?

Re: How do I find which specific Data Sources are lighting up the different Dashboards?

somesoni2 — Fri, 26 Feb 2016 03:46:32 GMT

Following query can give you list of dashboards and corresponding dashboard xml/code.

| rest /servicesNS/-/-/data/ui/views | table label eai:data | rename eai:data as code

Now based on how your dashboard users write searches, you can extract the data sources (index/source/sourcetype) from that field. Following can give you a sample to extract index names

 | rest /servicesNS/-/-/data/ui/views | table label eai:data | rename eai:data as code | rex field=data max_match=0 "\sindex\s*=\s*(?<indexes>\S+)"

Now, the users can specify one or more of index/source/sourcetype/eventtypes/tags/macros OR sometime nothing at all (not a good practice), so you can play around by trying to extract different data sources by adding multiple rex commands.

Update
Adding sourcetype extraction, fixing some typos of rex

 | rest /servicesNS/-/-/data/ui/views | table label eai:data | rename eai:data as code | rex field=code max_match=0 "\sindex\s*=[\s\"]*(?<indexes>[^\s\"]+)" | rex field=code max_match=0 "\ssourcetype\s*=[\s\"]*(?<sourcetypes>[^\s\"]+)"

Re: How do I find which specific Data Sources are lighting up the different Dashboards?

miajay1980 — Mon, 29 Feb 2016 14:39:31 GMT

Yes pablo populating the dashboards... I'm trying to compile a list of which source types are populating the dashboards.

Re: How do I find which specific Data Sources are lighting up the different Dashboards?

miajay1980 — Mon, 29 Feb 2016 14:57:55 GMT

Somesoni2

Not sure I completely follow this query. When I input the query into the search, I do get the XML for the various dashboards, but I dont see the source types that populate the different dashboards.

Re: How do I find which specific Data Sources are lighting up the different Dashboards?

somesoni2 — Mon, 29 Feb 2016 16:12:46 GMT

You would need to add extraction logic for sourcetype here (my answer is just extracting index name.)