topic Dashboard views by user using REST & index=_internal in Splunk Search

Dashboard views by user using REST & index=_internal

mgianola — Tue, 29 Sep 2020 07:57:41 GMT

I'd like to search dashboard views by user, which is stored in index=_internal. REST allows me to limit results using the isDashboard = 1 parameter. Is there a way to join this REST call to index=_internal so I can see dashboard usage without explicitly having to list or exclude dashboard objects in index=_internal?

index=_internal sourcetype=splunk_web_access
| join title type=inner [rest /servicesNS/-/-/data/ui/views | search isDashboard=1 isVisible=1] 
| stats count by app, view, user

Re: Dashboard views by user using REST & index=_internal

mgianola — Wed, 25 Nov 2015 19:37:47 GMT

Looks like this can be solved using rex:

index=_internal sourcetype=splunk_web_access
| rex field=uri_path ".*/(?<title>[^/]*)$"
| join title [rest /servicesNS/-/-/data/ui/views 
| search isDashboard=1 isVisible=1
| stats count by app, view, user

Re: Dashboard views by user using REST & index=_internal

jagadeeshm — Tue, 30 Jan 2018 13:46:12 GMT

I don't think this is working anymore!

Re: Dashboard views by user using REST & index=_internal

althomas — Thu, 12 Apr 2018 09:04:24 GMT

No, it looks like all the fields got updated. Here's a version that works for me:

index=_internal sourcetype=splunk_web_access host=<SEARCH HEAD> user=<USER> 
| rex field=uri_path ".*/(?<title>[^/]*)$" 
| join title app
    [| rest /servicesNS/-/-/data/ui/views splunk_server=local
    | search isDashboard=1 isVisible=1 
    | rename eai:acl.app as app 
    | stats count by title app 
    | fields - count ]
| table _time user title app