topic Re: Not getting all users for splunk Usage Query in Dashboards & Visualizations

Not getting all users for splunk Usage Query

aditsss — Mon, 09 Nov 2020 15:46:05 GMT

Hi All, I have used below query to check the usage of the dashboards. But I am not able to get all the users. Can someone guide me on that.

index=_internal sourcetype=splunkd_ui_access Infrastructure NOT splunkd user!="-" | rex field=uri "^/[^/]+/app/(?[^/]+)/(?[^?/\s]+)" | search NOT dashboard IN (alert alerts dashboards dataset datasets data_lab home lookup_edit reports report search splunk) | stats count by app dashboard user

Re: Not getting all users for splunk Usage Query

ITWhisperer — Mon, 09 Nov 2020 16:19:06 GMT

Not sure what the infrastructure part is doing in your search but this works for me

index=_internal sourcetype=splunkd_ui_access NOT splunkd user!="-" | rex field=uri "^/[^/]+/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search NOT dashboard IN (alert alerts dashboards dataset datasets data_lab home lookup_edit reports report search splunk) | stats count by app dashboard user

How do you know some users are missing? Is there something different about the events for these users?

Re: Not getting all users for splunk Usage Query

aditsss — Mon, 09 Nov 2020 16:21:13 GMT

@ITWhisperer

Infrastructure is my app name where dashboards are there . Also there are some users which visits the dashboards but whose name are not there.

Re: Not getting all users for splunk Usage Query

ITWhisperer — Mon, 09 Nov 2020 16:42:28 GMT

Are the same users always missing? Are the events completely missing or just the user being set to "-"?

Re: Not getting all users for splunk Usage Query

aditsss — Mon, 09 Nov 2020 17:06:19 GMT

Users are missing. I am not getting the name of all the users.