Dashboards & Visualizations

Not getting all users for splunk Usage Query

aditsss
Builder

Hi All, I have used below query to check the usage of the dashboards. But I am not able to get all the users. Can someone guide me on that.

index=_internal sourcetype=splunkd_ui_access Infrastructure NOT splunkd user!="-" | rex field=uri "^/[^/]+/app/(?[^/]+)/(?[^?/\s]+)" | search NOT dashboard IN (alert alerts dashboards dataset datasets data_lab home lookup_edit reports report search splunk) | stats count by app dashboard user

Labels (2)
0 Karma
1 Solution

ITWhisperer
Ultra Champion

Not sure what the infrastructure part is doing in your search but this works for me

index=_internal sourcetype=splunkd_ui_access NOT splunkd user!="-" | rex field=uri "^/[^/]+/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search NOT dashboard IN (alert alerts dashboards dataset datasets data_lab home lookup_edit reports report search splunk) | stats count by app dashboard user

How do you know some users are missing? Is there something different about the events for these users? 

View solution in original post

ITWhisperer
Ultra Champion

Not sure what the infrastructure part is doing in your search but this works for me

index=_internal sourcetype=splunkd_ui_access NOT splunkd user!="-" | rex field=uri "^/[^/]+/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search NOT dashboard IN (alert alerts dashboards dataset datasets data_lab home lookup_edit reports report search splunk) | stats count by app dashboard user

How do you know some users are missing? Is there something different about the events for these users? 

View solution in original post

aditsss
Builder

@ITWhisperer 

 

Infrastructure is my app name where dashboards are there . Also there are some users which visits the dashboards but whose name are not there.

0 Karma

ITWhisperer
Ultra Champion

Are the same users always missing? Are the events completely missing or just the user being set to "-"?

0 Karma

aditsss
Builder

Users are missing. I am not getting the name of all the users.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!