Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How to show the Dashboard count as 0 which is ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to show the Dashboard count as 0 which is not visited by any of the users
Hi Everyone,
I have one requirement. I am working on Usage Dashboard.
I am showing the Dashboard Name with count. I am getting the count for each and every Dashboard .
I want to show the count as 0 which is not visited by any of the user.
Below is my query.
index="_internal" sourcetype=splunkd_ui_access
file IN ( Data_Management
ELF_API
ELF_ApexCallout
ELF_ApexExecution
ELF_ApexSoap
ELF_ApexTrigger
ELF_AsyncReportRun
ELF_BulkApi
ELF_Console
ELF_ContentDocumentLink
)
| where isnull(uri_query) AND user!="-"
| stats count by file|table file count|sort -count
Can someone please guide me on that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A dashboard which has not been visited will not have an access record in Splunk. Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.
https://www.duanewaddle.com/proving-a-negative/
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cant I show the Dashboard name with count as 0 in Usage Dashboard.
I want to show negative reporting . Isn't that possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk searches your data for stuff and tells you what it finds. The list of things it did NOT find is infinite and would make for a very unhelpful report/dashboard. That's why you need a list of things for Splunk to search for and put in your dashboard.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe you could create a list of all your current dashboards and set the count field with an if function..
If the Name of your Dashboard in your self-made list exists in the index, output the count for the dashboard from the index otherwise output 0.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't want to create any lookup file .
Isn't it possible directly from splunk. I have more than 500 dashboards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In that case I can totally understand why you wouldn't want to create a custom list or lookup!
Interested in your problem I found out that you can get a complete list of your dashboards with the command:
| rest /servicesNS/-/-/data/ui/views
"-" are for user and app apparently.
Using the - - you'll see any dashboard on your system.
You could do a subsearch on it and return only the label of the dashboards as a column.. then compare the name column of your search with the label of the dashboard list and then do the if function from my first comment?
Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
