Dashboards & Visualizations

Is there a way to have a Dashboard in Splunk that contains a que of latest update of all indexes inside of Splunk?

Path Finder

I want to find a way to have a Dashboard in Splunk that contains a que of latest update of all indexes inside of Splunk.

The main objective is to identify Dashboards containing old information in order to remove all of them. Please let me know if this is possible and if so, how to do it too.

0 Karma

Esteemed Legend

Try the Meta Woot! app:
https://splunkbase.splunk.com/app/2949/

It is based of the metadata command mostly and this command tells you exactly what you need:
http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Metadata

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!