topic Re: How to create a dashboard that lists recently updated dashboards? in Splunk Search

How to create a dashboard that lists recently updated dashboards?

eyaluodba — Mon, 22 May 2017 15:37:42 GMT

my team has a lot of dashboards and I want to create a simple code for another one that groups and lists some of the dashboards that have been recently updated.

And if so when I search up these updated databases I would like to know the indexes and dataset that these dashboards have.

Requested Table format Dashboard Name, Index, Timestamp (Shows when the dashboard was last updated)

Here is the code I have so far. Now sure how to do the rest.

    <title>Dashboard Search</title>
    <search id="base"> 
      <query>index=_internal  | table  DashboardName Index Timestamp </query>
      <earliest>0</earliest>
      <latest></latest>
    </search>

Re: How to create a dashboard that lists recently updated dashboards?

vasanthmss — Mon, 22 May 2017 17:44:41 GMT

Use the below search to get the views that are edited,

index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name

Re: How to create a dashboard that lists recently updated dashboards?

eyaluodba — Mon, 22 May 2017 18:59:01 GMT

I get a "Error on line 2: Unexpected close tag

    <search id="base"> 
      <query> index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name </query>
      <earliest>0</earliest>
      <latest></latest>
    </search>

Re: How to create a dashboard that lists recently updated dashboards?

adonio — Mon, 22 May 2017 19:04:27 GMT

try this:

<dashboard>
  <label>Changed Views</label>
  <row>
    <panel>
      <title>who changed what when</title>
      <table>
        <search>
          <query>index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?&lt;app_name&gt;.\w+)/(?&lt;dashboard_name&gt;.\w+)" | table _time, user, app_name dashboard_name</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

Re: How to create a dashboard that lists recently updated dashboards?

eyaluodba — Mon, 22 May 2017 19:19:25 GMT

Thank you so much. It worked!

Re: How to create a dashboard that lists recently updated dashboards?

eyaluodba — Mon, 22 May 2017 19:56:32 GMT

Anyway I can also see the indexes?

Re: How to create a dashboard that lists recently updated dashboards?

adonio — Mon, 22 May 2017 20:27:58 GMT

do you mean the indexes a search / report / dashboard is using?

Re: How to create a dashboard that lists recently updated dashboards?

eyaluodba — Mon, 22 May 2017 21:17:00 GMT

Yes, like is there a way I can also add a new column to show the indexes that those databases are using?

Re: How to create a dashboard that lists recently updated dashboards?

adonio — Tue, 23 May 2017 13:07:56 GMT

@eyaluodba this data is a little more complex to grab as you will need to look at the search.log (in _internal and _audit indexes). it will require couple of steps process.
a. understand and capture which searches drives your views and who is the creator (will elaborate)
b. what is the syntax of the searches and if it has: index=a OR index=b etc...
c. understand the results and the indexes field values
d. if the role does not have access to indexes, the search will skip these particular indexes although the search syntax includes them
e. with that said, there are couple of answers here that covers some of it:
https://answers.splunk.com/answers/321581/how-to-find-the-most-searched-index-in-splunk.html
https://answers.splunk.com/answers/273176/how-can-i-determine-how-much-an-index-is-being-sea.html

Re: How to create a dashboard that lists recently updated dashboards?

eyaluodba — Tue, 23 May 2017 13:40:03 GMT

Thank you so much!

Re: How to create a dashboard that lists recently updated dashboards?

eyaluodba — Tue, 23 May 2017 15:08:33 GMT

So if I wanted to use | REST /services/data/indexes | table title
in my code, how would I go about doing that? Everytime I try to add it I get "Error in 'rest' command: This command must be the first command of a search."

Re: How to create a dashboard that lists recently updated dashboards?

eyaluodba — Tue, 29 Sep 2020 14:10:50 GMT

It wants me to put it up first, but when I do it doesn't work.

index=_internal source=web_access.log /app/ action=edit
| rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table dashboard_name, _time, app_name, user,

Re: How to create a dashboard that lists recently updated dashboards?

adonio — Tue, 23 May 2017 15:24:37 GMT

i think it will be good to open another question.
pay attention that the | rest /services/data/indexes only tells you about the indexes configurations and not about how they are being searched

Re: How to create a dashboard that lists recently updated dashboards?

eyaluodba — Tue, 23 May 2017 15:31:26 GMT

Alright thanks for all your help!