Dashboard usage metrics

[hmahendrakumar]

Is there a way to get the metrics for dashboard usage ?

[achille83]

If you want, you can use the following search in order to find dashboards being clicked and belonging apps, and by which user.

index="_internal" user!="-" sourcetype=splunkd_ui_access

| rex field=uri "/app/(?[^/]+)/(?[^?/\s]+)"
| search dashboard!="search" dashboard!="home" dashboard!="alert" dashboard!="lookup_edit" dashboard!="@go" dashboard!="data_lab" dashboard!="dataset" dashboard!="datasets" dashboard!="alerts" dashboard!="dashboards" dashboard!="reports" dashboard!="report"
| stats values(user) AS user count AS hits BY app dashboard
| join type=left dashboard
[ | rest /servicesNS/-/-/data/ui/views
| search isDashboard=1 isVisible=1 disabled=0
| table title eai:appName eai:acl.sharing
| rename title AS dashboard eai:appName AS app eai:acl.sharing AS appSharing]
| table app dashboard appSharing user hits
| sort 0 app

[hmahendrakumar]

Yes. I am looking for frequency of user access in this case.

[Lowell]

Here's a search I use to analyze which pages are being hit on the splunk web server. I'm not 100% sure that what your looking for though.

index=_internal sourcetype="splunk_web_access" "GET /en-US/app/" status=200 
| rex field=uri "/app/(?<app>[\w_]+)/(?<view_name>[\w._-]+)[/? ]"
| replace "report_builder_*" with "report_builder" in view_name
| stats count, dc(clientip) as clients, min(_time) as first_hit, max(_time) as last_hit by app,view_name
| convert ctime(*_hit)
| sort -count,app,view_name

Note that I have "en-US" hard coded in there. I forget why exactly, I think it gave me a performance boost and everyone around here only speaks English, so it isn't a big deal.

[southeringtonp]

What kind of metrics are you looking for? Search performance? Frequency of user access? Something else entirely?