All Apps and Add-ons

How to find dashboards that depend on a given splunk db connect database input?

dirtebird
Explorer

In Splunk Enterprise, Is there a way to find all the dashboards etc.. that consume data from a given database input that was set up in dbconnect?

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Not directly, since dashboards do not search for inputs, but for data.  The closest you can get is to search the dashboards for the host, source, and sourcetype produced by the given DBX input.

Start with this REST command

| rest splunk_server=local /services/data/ui/views

and search the data field for the appropriate values.  Keep in mind the values may be specified in an eventtype or macro.  It's also possible a dashboard is finding the data by happenstance because events contain the right text.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Not directly, since dashboards do not search for inputs, but for data.  The closest you can get is to search the dashboards for the host, source, and sourcetype produced by the given DBX input.

Start with this REST command

| rest splunk_server=local /services/data/ui/views

and search the data field for the appropriate values.  Keep in mind the values may be specified in an eventtype or macro.  It's also possible a dashboard is finding the data by happenstance because events contain the right text.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dirtebird
Explorer

@richgalloway Thanks for the reply.  I am completely new to Splunk and some of your replay went way over my head.  Where would I use the REST command that you provided?  Could you attach a screenshot?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Put the command in the Search & Reporting app or in the search box of any other app.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dirtebird
Explorer

@richgalloway  Ok, got it.  I did that, but none of the results returned came back with the database input that i am looking for.  I see in the search window there is a timeframe next to the search -  i set that to "Today" since i accessed the dashboard that uses my database input several times today.   And just to clarify, since im so new to Splunk, I am searching the results for the name of the database input that i see in the Data Lab->Inputs tab.  Does this sound correct?  I need to determine why i'm not finding the database input that I know exists and is being used, then go from there.  I appreciate your input

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As I wrote in my first reply, one does not search for inputs - one searches for data.  There is no built-in connection between the data in an index and the input that put it there.  You may be able to infer the input from host, source, or sourcetype, but those are not always definitive.  If they work in your environment then, of course, use them.

IOW, one cannot ask Splunk for all data that came from input=foo so you won't find such text in a dashboard.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...