Hi @Keerthi,
If you have a dashboard named "Your_Dashboard_Name", you can use the following query to see who visited it:
index=_internal sourcetype=splunkd_ui_access namespace=* user="*" search="*action*view*Your_Dashboard_Name*"
For special fields, you may need to create your own regex to extract the required information.
P.S.: Karma points are always appreciated 😉
its not working 😞
you have whitespaces in your query:
try to use:
best regards,
P.S.
another question: do you have admin permissions and can access the _internal index ?
index=_internal sourcetype=splunkd earliest=-1m
i wrote this code but no luck
index=_internal sourcetype=splunkd_ui_access
| rex field=uri_path "app/(?<app>[^/]+)/(?<dashboard>[^/]+)"
| search app="dashboards" dashboard="User_Management_Hourra"
| stats dc(user) as unique_users
@Keerthi Hello Keerthi, Please refer the below link.
https://splunkonbigdata.com/how-to-create-splunk-user-analysis-and-monitoring-dashboard/
hi kiran,
appreciate for the quick reply.
with the first link i tried the 1st query as he mentioned but no search results.
with the second link you shared me i could only see (screenshot for reference)
how do i query it for particular dashboard i am looking for?