topic Re: Locate when user(s) accessed dasboard in Dashboards & Visualizations

Locate when user(s) accessed dasboard

ralphw_SAIC — Fri, 25 Mar 2016 17:19:58 GMT

We have a group that is required to record when they review their individual dashboard. We are trying to use Splunk to show they logged in and viewed their dashboard. I am having issues figuring out a search to determine when a dashboard was accessed and by whom.

I just need the initial get of the dashboard, not every search that is in the dashboard.

Re: Locate when user(s) accessed dasboard

richgalloway — Fri, 25 Mar 2016 17:35:52 GMT

I think this will get you started.

index=_internal source="*/splunkd_ui_access.log" "<myapp>/data/ui/views/<dashboard-name>" | table _time user uri_path

Re: Locate when user(s) accessed dasboard

somesoni2 — Fri, 25 Mar 2016 18:02:34 GMT

I use this to track the same. (with some exclusion for settings type of dashboards)

index="_internal" source=*access* user!="-" user=* host=sk*s* OR host=sk*u* source="*splunkd_ui_access.log" "en-US/app"  | table _time user referer | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="dbquery" dashboard!="*en-US" dashboard!="search" dashboard!="home" dashboard!="alerts" dashboard!="dashboards" dashboard!="reports" dashboard!="report"