https://community.splunk.com/t5/Splunk-Search/How-to-find-alerts-and-dashboards-that-were-created-a-long-time/m-p/307910#M92360 <P>hello there,<BR /> here is one solution leveraging the | rest endpoints and the "updated" field that they provide:<BR /> first one is for your views / dashboards.<BR /> code:</P> <PRE><CODE>| rest /servicesNS/-/-/data/ui/views | search eai:acl.app = * | table title eai:acl.app eai:acl.owner updated | eval updated_epoch = strptime('updated', "%Y-%m-%dT%H:%M:%S-%:z") | eval now = now() | where updated_epoch &gt; now - 12960000 | sort - updated | fields - now updated_epoch </CODE></PRE> <P>the number 12960000 is approximately 5 months (in seconds) you can adjust as you wish<BR /> if you want to see all the saved items, change the first line in the code to this:</P> <PRE><CODE>| rest /services/saved/searches </CODE></PRE> <P>here is a sample screenshot. i created a dashboard couple of minutes ago to demonstrate it catches it. named it "transaction complete"<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3198iFDC1CE6AD738634F/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>hope it helps</P> <P>p.s. there are probably other ways to achieve what you are looking for. possibly in a better way too. also, you will probably want to filter the user = nobody items as i assume you are looking for views created by users and not by pre-built apps</P> Sat, 15 Jul 2017 02:28:58 GMT adonio 2017-07-15T02:28:58Z https://community.splunk.com/t5/Splunk-Search/How-to-find-alerts-and-dashboards-that-were-created-a-long-time/m-p/307909#M92359 <P>Is there any way to find out the alerts and dashboards created like 5 months ago and with the respective user names?</P> Fri, 14 Jul 2017 20:44:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-alerts-and-dashboards-that-were-created-a-long-time/m-p/307909#M92359 kteng2024 2017-07-14T20:44:28Z https://community.splunk.com/t5/Splunk-Search/How-to-find-alerts-and-dashboards-that-were-created-a-long-time/m-p/307910#M92360 <P>hello there,<BR /> here is one solution leveraging the | rest endpoints and the "updated" field that they provide:<BR /> first one is for your views / dashboards.<BR /> code:</P> <PRE><CODE>| rest /servicesNS/-/-/data/ui/views | search eai:acl.app = * | table title eai:acl.app eai:acl.owner updated | eval updated_epoch = strptime('updated', "%Y-%m-%dT%H:%M:%S-%:z") | eval now = now() | where updated_epoch &gt; now - 12960000 | sort - updated | fields - now updated_epoch </CODE></PRE> <P>the number 12960000 is approximately 5 months (in seconds) you can adjust as you wish<BR /> if you want to see all the saved items, change the first line in the code to this:</P> <PRE><CODE>| rest /services/saved/searches </CODE></PRE> <P>here is a sample screenshot. i created a dashboard couple of minutes ago to demonstrate it catches it. named it "transaction complete"<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3198iFDC1CE6AD738634F/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>hope it helps</P> <P>p.s. there are probably other ways to achieve what you are looking for. possibly in a better way too. also, you will probably want to filter the user = nobody items as i assume you are looking for views created by users and not by pre-built apps</P> Sat, 15 Jul 2017 02:28:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-alerts-and-dashboards-that-were-created-a-long-time/m-p/307910#M92360 adonio 2017-07-15T02:28:58Z