topic Re: find last time dashboard run in Dashboards & Visualizations

find last time dashboard run

sarit_s — Wed, 10 Nov 2021 07:27:24 GMT

Hello

is it possible to get a list of all the dashboards that was running for the last * days ?

Re: find last time dashboard run

isoutamo — Wed, 10 Nov 2021 09:24:46 GMT

Yes it's possible. You can start with this query, if you have access to _audit log.

index=_audit user!=splunk-system-user app=* provenance="*" | stats last(_time) as _time count values(provenance) as Dashboard by app

r. Ismo

Re: find last time dashboard run

sarit_s — Wed, 10 Nov 2021 09:47:05 GMT

thanks, it looks good but i need the last time of each dashboard and not grouped by app

Re: find last time dashboard run

isoutamo — Wed, 10 Nov 2021 09:58:34 GMT

Like this?

index=_audit user!=splunk-system-user app=* provenance="*" | stats last(_time) as _time count by provenance | rename provenance as Dashboard

r. Ismo

Re: find last time dashboard run

sarit_s — Wed, 10 Nov 2021 10:04:32 GMT

thanks

is it possible to add the user to this list ?

Re: find last time dashboard run

isoutamo — Wed, 10 Nov 2021 10:13:24 GMT

index=_audit user!=splunk-system-user app=* provenance="*" | stats last(_time) as _time values(user) as users count by provenance | rename provenance as Dashboard

If you haven't enough user experience about Splunk and SPL there are lot of trainings available. Some free and other payable. You can found Splunk's own training offerings from https://education.splunk.com/catalog

There is also lot of other training / learning material on other sites including YouTube.

r. Ismo