topic Re: How to get dashboard not accessed by anyone in splunk in Splunk Search

How to get dashboard not accessed by anyone in splunk

harishsplunk7 — Wed, 12 Feb 2025 23:23:06 GMT

I am want to get the list of dashboard which is not used by anyone for more than 90 days. i have tired to use the below query but didnt work well.

| rest splunk_server=local "/servicesNS/-/-/data/ui/views"
| rename title as dashboard
| fields dashboard

| eval accessed=0
| search NOT
[ search index=_internal sourcetype=splunkd_ui_access earliest=-90d@d
| rex field=uri "/app/[^/]+/(?<dashboard>[^?/\s]+)"
| search NOT dashboard IN ("search", "home", "alert", "lookup_edit", "@go", "data_lab", "dataset", "datasets", "alerts", "dashboards", "reports")
| stats count as accessed by dashboard
| fields dashboard, accessed
]
| stats sum(accessed) as total_accessed by dashboard
| where total_accessed=0
| table dashboard

Re: How to get dashboard not accessed by anyone in splunk

livehybrid — Thu, 13 Feb 2025 00:17:52 GMT

Hi @harishsplunk7

I dont think your search covers Dashboard Studio dashboards, only Simple XML dashboards (but could be wrong)
Have a go with the following search and let me know how you get on!

index=_internal sourcetype=splunkd_ui_access earliest=-90d@d uri="*/data/ui/views/*" | rex field=uri "/servicesNS/(?<user>[^/]+)/(?<app>[^/]+)/data/ui/views/(?<dashboard>[^\.?/\s]+)" | search NOT dashboard IN ("search", "home", "alert", "lookup_edit", "@go", "data_lab", "dataset", "datasets", "alerts", "dashboards", "reports") | stats count as accessed by app, dashboard | append [| rest splunk_server=local "/servicesNS/-/-/data/ui/views" | rename title as dashboard, eai:acl.app as app | fields dashboard app | eval isDashboard=1] | stats sum(accessed) as accessed, values(isDashboard) as isDashboard by app, dashboard | search isDashboard=1 accessed>0

Re: How to get dashboard not accessed by anyone in splunk

harishsplunk7 — Thu, 13 Feb 2025 03:13:36 GMT

Thank you for your response, but your query is providing list of dashboard accessed and i am looking for number of unused/not accessed by anyone.

Re: How to get dashboard not accessed by anyone in splunk

livehybrid — Thu, 13 Feb 2025 08:47:26 GMT

Ahhh sorry @harishsplunk7 - I misread!

I've rearranged the query a bit now, how does this look?

| rest splunk_server=local "/servicesNS/-/-/data/ui/views" | rename title as dashboard, eai:acl.app as app | fields dashboard app | eval isDashboard=1 | append [ search index=_internal sourcetype=splunkd_ui_access earliest=-90d@d uri="*/data/ui/views/*" | rex field=uri "/servicesNS/(?<user>[^/]+)/(?<app>[^/]+)/data/ui/views/(?<dashboard>[^\.?/\s]+)" | search NOT dashboard IN ("search", "home", "alert", "lookup_edit", "@go", "data_lab", "dataset", "datasets", "alerts", "dashboards", "reports") | stats count as accessed by app, dashboard ] | stats sum(accessed) as accessed, values(isDashboard) as isDashboard by app, dashboard | fillnull accessed value=0 | search isDashboard=1 accessed=0

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will