Is there a way to find out which dashboards across all applications aren't being used through Splunk?

[idp]

Hello,

I need to find out which dashboards across all applications aren't being used. Is there a way to do this through Splunk?

Thanks.

[isoutamo]

Hi

you could try something like this

| rest /servicesNS/-/-/data/ui/views splunk_server=<your SH server e.g. local> 
| search isDashboard=1 
| fields title eai:acl.app 
| join type=left title 
    [| search index=_internal sourcetype=splunk_web_access host=* user=* 
    | rex field=uri_path ".*/(?<title>[^/]*)$" 
    | stats latest(_time) as _time by title
        ] 
| where isnull(_time)

r. Ismo 

[idp]

Hello, this returned all the dashboards within my environment. Any way to maybe add the # of user visits?

[isoutamo]

That subsearch find the last access times for those dashboards. If there is no access, then it shows that dashboard (last where is null). If you want all then remove that “where” and keep _time to see last access time.

[isoutamo]

Of course if your retention for *access.logs are too low then this query didn’t found those entries and show more than expected.