Dashboards & Visualizations

How to delete many unused dashboards?

grivera_kudaw
Explorer

Hi,
I need help.
My question is related to unused dashboards.

Curently I have more than 2000 dashboard unused, I need a method to disable and delete from my Splunk Cluster.
Did anyone apply a procedure to remove a large number of panels from the Splunk Cluster?
wich steps I need to delete thats dashboards?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @grivera_kudaw,
you can delete dashboards from UI interface as an administrator.

My hint is to search in _internal how long they aren't used:

 index="_internal" user!="-"  sourcetype=splunkd_ui_access "en-US/app"  
| rex field=uri "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)"
| search  dashboard!="search" dashboard!="home" dashboard!="alert" dashboard!="lookup_edit" dashboard!="@go" dashboard!="data_lab" dashboard!="dataset" dashboard!="datasets" dashboard!="alerts" dashboard!="dashboards" dashboard!="reports" dashboard!="report" 

or

 index="_internal" user!="-"  sourcetype=splunkd_ui_access "en-US/app"  
| rex field=uri "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)"
| search  dashboard="my_unused_dashboard"

so you can be sure that the dashboard is unused in the last period.

To be more sure you could also change access rights on the deleting dashboards (recording old rights) and wait for a period that none shous!
Then you can delete them from UI interface as an administrator, eventually copying sources in a test off-line file.

Ciao.
Giuseppe

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...