Dashboards & Visualizations

Can you find a way to see if a report is attached to a dashboard?

HealyManTech
Explorer

Is there a way to see if a report is attached to a dashboard?

I am clean up report and don't remember which ones I had attached to my daily dashboards. Does anyone know? Or if you go to delete a report will it tell you something like this "This report is part of Dashboard Name?

Thanks for the help.

0 Karma
1 Solution

niketn
Legend

@HealyManTech you can run the following REST command to pull all views (dashboards/forms) which refer to your report Your Report Name

|  rest /servicesNS/-/-/data/ui/views/
|  search "eai:data"="*Your Report Name*"

PS:
1) The hyphens after servicesNS represent all user and all apps. You can provide specific user name or app name if required. Another option would be to pull all users and all apps and filter afterwards with "eai:appName" and eai:acl.owner respectively.

2) Wildcards asterisk * are required before and after "*Your Report Name*" to match across Dashboard Code. Reports can be included in Dashboard using <ref="Your Report Name"> or it can also be run using | savedsearch "Your Report Name" command.

Do backup the code for your Report from savedsearches.conf and local.meta file.
Please try out and confirm!

Refer to Splunk Documentation for REST API :http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Fui.2Fviews

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@HealyManTech you can run the following REST command to pull all views (dashboards/forms) which refer to your report Your Report Name

|  rest /servicesNS/-/-/data/ui/views/
|  search "eai:data"="*Your Report Name*"

PS:
1) The hyphens after servicesNS represent all user and all apps. You can provide specific user name or app name if required. Another option would be to pull all users and all apps and filter afterwards with "eai:appName" and eai:acl.owner respectively.

2) Wildcards asterisk * are required before and after "*Your Report Name*" to match across Dashboard Code. Reports can be included in Dashboard using <ref="Your Report Name"> or it can also be run using | savedsearch "Your Report Name" command.

Do backup the code for your Report from savedsearches.conf and local.meta file.
Please try out and confirm!

Refer to Splunk Documentation for REST API :http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Fui.2Fviews

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

HealyManTech
Explorer

If it comes back with zero results would that mean it wasn't saved anywhere?

0 Karma

niketn
Legend

If you are sure of a dashboard that uses this or any other Saved Search, you can try adjusting the query to test. Also, can you provide the current search you are running (mask/anonymize any sensitive information)?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...