Dashboards & Visualizations

case - how to find the dashboard usage data

Explorer

Comment: Usage of dashboard is a bad practice as this adds a lot of load to splunk.

My question: How do I validate this? I want to find in what frequency are dashboards being used. Most of the time people use them occasionally.

Another team want to run these queries regularly and move them to graphite to which I disagree.

Tags (3)
0 Karma

Explorer

Another team at office 🙂

0 Karma

SplunkTrust
SplunkTrust

Take a look at the SoS app's UI and User Search Activity dashboard to get a quick view of what's being used when and how often: http://apps.splunk.com/app/748/

Explorer

Thanks Martin. Will check

0 Karma

SplunkTrust
SplunkTrust

This query could be a start (not fine tuned)

index=_internal source=*access.log */app/* | rex "\/app\/(?<AppName>\w+)\/(?<ViewName>\w+)\"" | search AppName=* AND ViewName=* | table _time, AppName, ViewName, user

Explorer

I am a Splunk admin..and the view was created by me.. but looks like when others use, I don't see it being reported.

index=internal source=access.log */app/ | rex "\/app\/(?\w+)\/(?\w+)\"" | search AppName=* AND ViewName=S*_Env

0 Karma

Explorer

I will try it out.

0 Karma

Legend

Just a question: who is saying what? No, using dashboards is not "bad practice" because it's a vital part for many of using Splunk.