Dashboards & Visualizations

Not getting all users for splunk Usage Query

aditsss
Motivator

Hi All, I have used below query to check the usage of the dashboards. But I am not able to get all the users. Can someone guide me on that.

index=_internal sourcetype=splunkd_ui_access Infrastructure NOT splunkd user!="-" | rex field=uri "^/[^/]+/app/(?[^/]+)/(?[^?/\s]+)" | search NOT dashboard IN (alert alerts dashboards dataset datasets data_lab home lookup_edit reports report search splunk) | stats count by app dashboard user

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Not sure what the infrastructure part is doing in your search but this works for me

index=_internal sourcetype=splunkd_ui_access NOT splunkd user!="-" | rex field=uri "^/[^/]+/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search NOT dashboard IN (alert alerts dashboards dataset datasets data_lab home lookup_edit reports report search splunk) | stats count by app dashboard user

How do you know some users are missing? Is there something different about the events for these users? 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Not sure what the infrastructure part is doing in your search but this works for me

index=_internal sourcetype=splunkd_ui_access NOT splunkd user!="-" | rex field=uri "^/[^/]+/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search NOT dashboard IN (alert alerts dashboards dataset datasets data_lab home lookup_edit reports report search splunk) | stats count by app dashboard user

How do you know some users are missing? Is there something different about the events for these users? 

aditsss
Motivator

@ITWhisperer 

 

Infrastructure is my app name where dashboards are there . Also there are some users which visits the dashboards but whose name are not there.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are the same users always missing? Are the events completely missing or just the user being set to "-"?

0 Karma

aditsss
Motivator

Users are missing. I am not getting the name of all the users.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...