topic Re: Splunk query or rest API to list down the advanced xml dashboards in Dashboards & Visualizations

Splunk query or rest API to list down the advanced xml dashboards

rahulbhatia — Tue, 20 Aug 2019 09:49:43 GMT

I want to create an alert to notify the users if they create a dashboard using advance xml or calling a script

Re: Splunk query or rest API to list down the advanced xml dashboards

traxxasbreaker — Tue, 20 Aug 2019 12:51:31 GMT

I would start with this search:

| rest  /servicesNS/-/-/data/ui/views

The eai:data field should have the dashboard XML, and with that you should be able to regex out what you are looking for.

I'd probably use evals and do something like this:

 | eval contains_adanced_xml=if(match(eai:data, ".*<module .*"), "1", "0")
 | eval contains_script=if(match(eai:data, "<dashboard script=.*>", "1", "0")

You'll likely need to refine those conditionals a little bit, but once those are good you'd be able to just grab the dashboards that meet either condition and setup an alert.

Re: Splunk query or rest API to list down the advanced xml dashboards

rahulbhatia — Tue, 03 Sep 2019 15:08:10 GMT

This is what i was looking for, thanks a lot