Dashboards & Visualizations

All Dashboard Listing

anil15694
Explorer

How can I list out all the dashboards available in all the apps in my Splunk environment?

0 Karma

niketn
Legend

@anil15694 Please refer to one of my older answers with REST API /data/ui/views, that can be used to pull available dashboards based on App Context and User context.

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-a-dashboard-as-value-in-dropdo...

Please try out and confirm. If this does not solve, please provide additional details for your use case.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bowesmana
SplunkTrust
SplunkTrust
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

e.g. the next query list all Splunk KOs. The last line selects just Dashboards.

Thanx for this query for someone (couldn't recall who was the originator of this). 

 

| rest /servicesNS/-/-/admin/directory count=0 splunk_server=local | fields eai:acl.app, eai:acl.owner, eai:acl.perms.*, eai:acl.sharing, title, eai:type, disabled
| foreach eai:*.* 
    [ rename "<<FIELD>>" TO <<MATCHSEG2>> ]
| foreach eai:* 
    [ rename "<<FIELD>>" TO <<MATCHSTR>> ]
| eval attribute=replace(title,"(.*:\s+)(.*)","\2")
| eval st=replace(title,"(.*)(\s+:.*)","\1")
| eval props_sourcetype=if(st==attribute,"",st)
| join type=outer attribute
    [| rest /servicesNS/-/-/admin/props-extract count=0 splunk_server=local | fields attribute value stanza type | rename value TO props_value, stanza to props_stanza, type to props_type ]
| join type=outer attribute
    [| rest /servicesNS/-/-/admin/transforms-extract count=0 splunk_server=local
    | fields REGEX FORMAT disabled eai:acl.app title FIELDS
    | makemv delim="," FIELDS
    | rename FIELDS to tf_fields, disabled to tf_disabled, REGEX to tf_regex, FORMAT to tf_format, title to attribute, eai:acl.app to tf_app]
| fillnull disabled tf_disabled
| table disabled app type attribute props_type props_stanza props_value props_sourcetype tf_disabled tf_format tf_fields tf_regex sharing perms.* location owner |  search (app="*" AND (sharing="*")) AND disabled=*  
| rename attribute TO "Object Name"
| where type == "views"

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...