- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to show the Dashboard count as 0 which is not ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to show the Dashboard count as 0 which is not visited by any of the users
Hi Everyone,
I have one requirement. I am working on Usage Dashboard.
I am showing the Dashboard Name with count. I am getting the count for each and every Dashboard .
I want to show the count as 0 which is not visited by any of the user.
Below is my query.
index="_internal" sourcetype=splunkd_ui_access
file IN ( Data_Management
ELF_API
ELF_ApexCallout
ELF_ApexExecution
ELF_ApexSoap
ELF_ApexTrigger
ELF_AsyncReportRun
ELF_BulkApi
ELF_Console
ELF_ContentDocumentLink
)
| where isnull(uri_query) AND user!="-"
| stats count by file|table file count|sort -count
Can someone please guide me on that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A dashboard which has not been visited will not have an access record in Splunk. Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.
https://www.duanewaddle.com/proving-a-negative/
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cant I show the Dashboard name with count as 0 in Usage Dashboard.
I want to show negative reporting . Isn't that possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk searches your data for stuff and tells you what it finds. The list of things it did NOT find is infinite and would make for a very unhelpful report/dashboard. That's why you need a list of things for Splunk to search for and put in your dashboard.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe you could create a list of all your current dashboards and set the count field with an if function..
If the Name of your Dashboard in your self-made list exists in the index, output the count for the dashboard from the index otherwise output 0.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't want to create any lookup file .
Isn't it possible directly from splunk. I have more than 500 dashboards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In that case I can totally understand why you wouldn't want to create a custom list or lookup!
Interested in your problem I found out that you can get a complete list of your dashboards with the command:
| rest /servicesNS/-/-/data/ui/views
"-" are for user and app apparently.
Using the - - you'll see any dashboard on your system.
You could do a subsearch on it and return only the label of the dashboards as a column.. then compare the name column of your search with the label of the dashboard list and then do the if function from my first comment?
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
