topic Re: Is it possible to determine obsolete dashboards? in Splunk Search

Is it possible to determine obsolete dashboards?

python — Mon, 07 Apr 2025 16:50:52 GMT

Is it possible to identify obsolete dashboards? or the last time a dashboard was executed?

Re: Is it possible to determine obsolete dashboards?

livehybrid — Mon, 07 Apr 2025 16:57:27 GMT

Hi @python

Check out this app https://splunkbase.splunk.com/app/7300 (Splunk app for Redundant or Inefficient Search Spotting)

This has dashboards for identifying things like unused dashboards and other knowledge objects.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Is it possible to determine obsolete dashboards?

python — Mon, 07 Apr 2025 17:15:15 GMT

you can use this q uery as reference | rest splunk_server=local /servicesNS/-/-/data/ui/views
| rename title AS "Dashboard Name", eai:acl.app AS Application, eai:acl.owner AS Owner, id as dashboard_id
| eval dashboard_name=replace(dashboard_id, ".*/data/ui/views/([^/]+)$", "\1")
| eval dashboard_name=urldecode(dashboard_name)
| fields "Dashboard Name", Application, Owner, dashboard_name
| join type=left dashboard_name
[ search index=_internal sourcetype IN ("splunk_web_service", "splunkd_access")
| rex "Rendering dashboard \\\"(?<rendered_dashboard>[^\"]+)"
| eval uri_decode = urldecode(uri)
| rex field=uri_decode "data/ui/views/(?<rendered_dashboard>[^$]+)$"
| search rendered_dashboard=* NOT rendered_dashboard="_new"
| transaction rendered_dashboard maxspan=2s
| stats last(_time) AS last_viewed_time BY rendered_dashboard
| eval dashboard_name=rendered_dashboard
| fields dashboard_name, last_viewed_time
]
| eval "Last Viewed Time"=if(isnull(last_viewed_time), "Never Viewed", strftime(last_viewed_time, "%m/%d/%Y %H:%M:%S"))
| table "Dashboard Name", Application, Owner, "Last Viewed Time"

Re: Is it possible to determine obsolete dashboards?

livehybrid — Mon, 07 Apr 2025 18:07:36 GMT

Hi @python

Did you try the SPL I gave on your previous post to look at dashboard usage in the last 60 days?

index=_audit provenance=* app=* info=completed earliest=-60d provenance!="N/A" app!="N/A" provenance!="UI:Search" provenance!="Scheduler" | eval provenance=replace(replace(provenance,"UI:Dashboard:",""),"UI:dashboard:","") | stats latest(user) as last_user, latest(_time) as latest_access, dc(search_id) as searches by provenance, app | append [| rest /servicesNS/-/-/data/ui/views splunk_server=local count=0 | fields eai:acl.app title name eai:acl.owner isVisible | rename eai:acl.app as app, title as provenance, eai:acl.owner as owner ] | stats values(*) as * by provenance, app | where searches>1 | eval latest_access_readble=strftime(latest_access,"%Y-%m-%d %H:%M:%S")

I will work on the SPL you have provided to show completely unused dashboards in the selected time period.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Is it possible to determine obsolete dashboards?

livehybrid — Mon, 07 Apr 2025 18:26:24 GMT

Hi @python

The following SPL search can used to determine the dashboards which have NOT been used in the last 60 days. There are multiple ways to achieve this however I've gone with the approach of using the _audit index which records the dashboard ID as "provenance" and matches it to the results of the ui/views rest endpoint to ensure we have a list of all dashboards.

index=_audit info=completed action=search provenance!="N/A" provenance!="UI:Search" provenance!="scheduler" earliest=-60d latest=now | stats count by provenance app | eval provenance=replace(replace(provenance,"UI:dashboard:",""),"UI:Dashboard:","") | append [| rest splunk_server=local /servicesNS/-/-/data/ui/views | rename title AS provenance, eai:acl.app AS app] | stats sum(count) as search_count by provenance app | fillnull search_count value=0 | where search_count=0

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing