Getting Data In

How to list all the log fragments, phrases, regexes and so on that are used in my dashboards?

adrianmander
New Member

We have a number of very useful Splunk dashboards built up for our application. It seems that every time we release, we are surprised to discover that someone inadvertently broke a Splunk dashboard widget because they changed a log line. It would be great to have a dynamically generated, self-updating list for all our dashboards of the log-line fragments, regexes etc. that are used. That way we could refer to this list and easily know in development and reviews when changes are going to break something in Splunk.

Is there an easy way to generate this kind of list? Ideally you would feed it a list of particular dashboards you don't want to break.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There is no built-in way to do that. You could create your own search using |rest /servicesNS/-/-/saved/searches and | rest /servicesNS/-/-/data/views and scanning the text of each result for something like quotation marks. You'll still have a ton of false positives to scan by hand.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no built-in way to do that. You could create your own search using |rest /servicesNS/-/-/saved/searches and | rest /servicesNS/-/-/data/views and scanning the text of each result for something like quotation marks. You'll still have a ton of false positives to scan by hand.

---
If this reply helps you, Karma would be appreciated.
0 Karma

diogofgm
SplunkTrust
SplunkTrust

what do you mean with log line in the dashboard context?

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...