topic Re: How to get dashboard information on users who ran it and time it ran in Dashboards & Visualizations

How to get dashboard information on users who ran it and time it ran

rosh_dsa — Wed, 30 Oct 2019 16:01:31 GMT

How do I get dashboard info, like title of dashboard, uri_path, search (query) on the tiles, user who ran it and last time it ran ?
I am new to Splunk.
I am looking at using:

index=_internal sourcetype=splunkd_ui_access uri="/en-US/app/*/*"

Any directions much appreciated.

Re: How to get dashboard information on users who ran it and time it ran

aberkow — Wed, 30 Oct 2019 17:04:22 GMT

If you have access to your monitoring console https://docs.splunk.com/Documentation/Splunk/7.3.2/DMC/DMCoverview (under Settings -> Monitoring Console [lower left panel]) and can drill down into the Search dropdown (Search -> Search Activity: Instance) there are a number of searches that are pre-written that give information on who ran what searches when. This has the "Provenance" field, which can be a dashboard, and the search looks like it uses the _introspection index.

I would suggest starting here as this will likely offer you more information than anything a single answer here can provide, I use the console a ton and have learned a lot about our deployment and usage from it.

Hope this helps!

Re: How to get dashboard information on users who ran it and time it ran

niketn — Wed, 30 Oct 2019 17:46:28 GMT

@rosh_dsa refer to the answer by @cmerriman if you are looking to create your own query for Splunk Dashboard Usage: https://answers.splunk.com/answers/617051/how-can-i-create-a-query-to-find-dashboard-usage-a.html

Re: How to get dashboard information on users who ran it and time it ran

rosh_dsa — Wed, 30 Oct 2019 17:47:30 GMT

Thank you, I'll check on this, as long as I can pull a query from it.

Re: How to get dashboard information on users who ran it and time it ran

arjunpkishore5 — Wed, 30 Oct 2019 17:48:43 GMT

This will give you the dashboard definition

| rest /servicesNS/-/-/data/ui/views

And this will give you dashboard usage metrics

index=_internal sourcetype=splunkd_ui_access 
    [| rest /servicesNS/-/-/data/ui/views 
    | rename eai:acl.app as app 
    | search NOT app=system 
    | strcat "GET*/app/" app "/" title dashboard 
    | table dashboard 
    | rename dashboard as search 
    | format] 
| rex field=other "\s(?<response_time_ms>\d+)ms" 
| rex field=uri_path "\/app\/(?<app>[^\/]+)\/(?<dashboard>\S+)" 
| table _time, host, user, app, dashboard, response_time_ms

Hope this helps.

Please upvote and mark as answer if this is what you were looking for.

Regards
Arjun