Dashboards & Visualizations

case - how to find the dashboard usage data

jibiuthaman
Explorer

Comment: Usage of dashboard is a bad practice as this adds a lot of load to splunk.

My question: How do I validate this? I want to find in what frequency are dashboards being used. Most of the time people use them occasionally.

Another team want to run these queries regularly and move them to graphite to which I disagree.

Tags (3)
0 Karma

jibiuthaman
Explorer

Another team at office 🙂

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Take a look at the SoS app's UI and User Search Activity dashboard to get a quick view of what's being used when and how often: http://apps.splunk.com/app/748/

jibiuthaman
Explorer

Thanks Martin. Will check

0 Karma

somesoni2
SplunkTrust
SplunkTrust

This query could be a start (not fine tuned)

index=_internal source=*access.log */app/* | rex "\/app\/(?<AppName>\w+)\/(?<ViewName>\w+)\"" | search AppName=* AND ViewName=* | table _time, AppName, ViewName, user

jibiuthaman
Explorer

I am a Splunk admin..and the view was created by me.. but looks like when others use, I don't see it being reported.

index=internal source=access.log */app/ | rex "\/app\/(?\w+)\/(?\w+)\"" | search AppName=* AND ViewName=S*_Env

0 Karma

jibiuthaman
Explorer

I will try it out.

0 Karma

Ayn
Legend

Just a question: who is saying what? No, using dashboards is not "bad practice" because it's a vital part for many of using Splunk.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...