Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Can you find a way to see if a report is attached ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to see if a report is attached to a dashboard?
I am clean up report and don't remember which ones I had attached to my daily dashboards. Does anyone know? Or if you go to delete a report will it tell you something like this "This report is part of Dashboard Name?
Thanks for the help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@HealyManTech you can run the following REST command to pull all views (dashboards/forms) which refer to your report Your Report Name
| rest /servicesNS/-/-/data/ui/views/
| search "eai:data"="*Your Report Name*"
PS:
1) The hyphens after servicesNS represent all user and all apps. You can provide specific user name or app name if required. Another option would be to pull all users and all apps and filter afterwards with "eai:appName" and eai:acl.owner respectively.
2) Wildcards asterisk * are required before and after "*Your Report Name*" to match across Dashboard Code. Reports can be included in Dashboard using <ref="Your Report Name"> or it can also be run using | savedsearch "Your Report Name" command.
Do backup the code for your Report from savedsearches.conf and local.meta file.
Please try out and confirm!
Refer to Splunk Documentation for REST API :http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Fui.2Fviews
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@HealyManTech you can run the following REST command to pull all views (dashboards/forms) which refer to your report Your Report Name
| rest /servicesNS/-/-/data/ui/views/
| search "eai:data"="*Your Report Name*"
PS:
1) The hyphens after servicesNS represent all user and all apps. You can provide specific user name or app name if required. Another option would be to pull all users and all apps and filter afterwards with "eai:appName" and eai:acl.owner respectively.
2) Wildcards asterisk * are required before and after "*Your Report Name*" to match across Dashboard Code. Reports can be included in Dashboard using <ref="Your Report Name"> or it can also be run using | savedsearch "Your Report Name" command.
Do backup the code for your Report from savedsearches.conf and local.meta file.
Please try out and confirm!
Refer to Splunk Documentation for REST API :http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Fui.2Fviews
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If it comes back with zero results would that mean it wasn't saved anywhere?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are sure of a dashboard that uses this or any other Saved Search, you can try adjusting the query to test. Also, can you provide the current search you are running (mask/anonymize any sensitive information)?
| makeresults | eval message= "Happy Splunking!!!"
Thanks for the Memories! Splunk University, .conf25, and our Community
Data Persistence in the OpenTelemetry Collector
Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever
