How to show the Dashboard count as 0 which is not visited by any of the users

[aditsss]

Hi Everyone,

I have one requirement. I am working on Usage Dashboard.

I am showing the Dashboard Name with count. I am getting the count for each and every Dashboard .

I want to show the count as 0 which is not visited by any of the user.

Below is my query. 

index="_internal" sourcetype=splunkd_ui_access
file IN ( Data_Management
ELF_API
ELF_ApexCallout
ELF_ApexExecution
ELF_ApexSoap
ELF_ApexTrigger
ELF_AsyncReportRun
ELF_BulkApi
ELF_Console
ELF_ContentDocumentLink
)
| where isnull(uri_query) AND user!="-"
| stats count by file|table file count|sort -count

Can someone please guide me on that.

[richgalloway]

A dashboard which has not been visited will not have an access record in Splunk.  Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

[aditsss]

@richgalloway 

Cant I show the Dashboard name with count as 0 in Usage Dashboard.

I want to show negative reporting . Isn't that possible?

[richgalloway]

Splunk searches your data for stuff and tells you what it finds.  The list of things it did NOT find is infinite and would make for a very unhelpful report/dashboard.  That's why you need a list of things for Splunk to search for and put in your dashboard.

[FelixLeh]

Maybe you could create a list of all your current dashboards and set the count field with an if function..
If the Name of your Dashboard in your self-made list exists in the index, output the count for the dashboard from the index otherwise output 0.

[aditsss]

@FelixLeh 

I don't want to create any lookup file . 

Isn't it possible directly from splunk. I have more than 500 dashboards.

[FelixLeh]

In that case I can totally understand why you wouldn't want to create a custom list or lookup! 
Interested in your problem I found out that you can get a complete list of your dashboards with the command:

| rest /servicesNS/-/-/data/ui/views

"-" are for user and app apparently.
Using the - - you'll see any dashboard on your system.

You could do a subsearch on it and return only the label of the dashboards as a column.. then compare the name column of your search with the label of the dashboard list and then do the if function from my first comment?