How do I find which specific Data Sources are lighting up the different Dashboards?

[miajay1980]

Is there any easy way to see which Data Source lights up specific Dashboards? I am creating documentation, and would like to include the data sources lighting up the different Dashboards.

[somesoni2]

Following query can give you list of dashboards and corresponding dashboard xml/code.

| rest /servicesNS/-/-/data/ui/views | table label eai:data | rename eai:data as code 

Now based on how your dashboard users write searches, you can extract the data sources (index/source/sourcetype) from that field. Following can give you a sample to extract index names

 | rest /servicesNS/-/-/data/ui/views | table label eai:data | rename eai:data as code | rex field=data max_match=0 "\sindex\s*=\s*(?<indexes>\S+)"

Now, the users can specify one or more of index/source/sourcetype/eventtypes/tags/macros OR sometime nothing at all (not a good practice), so you can play around by trying to extract different data sources by adding multiple rex commands.

Update
Adding sourcetype extraction, fixing some typos of rex

 | rest /servicesNS/-/-/data/ui/views | table label eai:data | rename eai:data as code | rex field=code max_match=0 "\sindex\s*=[\s\"]*(?<indexes>[^\s\"]+)" | rex field=code max_match=0 "\ssourcetype\s*=[\s\"]*(?<sourcetypes>[^\s\"]+)"

[miajay1980]

Somesoni2

Not sure I completely follow this query. When I input the query into the search, I do get the XML for the various dashboards, but I dont see the source types that populate the different dashboards.

[somesoni2]

You would need to add extraction logic for sourcetype here (my answer is just extracting index name.)

[ppablo]

Hi @miajay1980

Can you clarify what you mean by "lighting up" dashboards? Do you mean populating dashboards with data?

[miajay1980]

Yes pablo populating the dashboards... I'm trying to compile a list of which source types are populating the dashboards.