Comment: Usage of dashboard is a bad practice as this adds a lot of load to splunk.
My question: How do I validate this? I want to find in what frequency are dashboards being used. Most of the time people use them occasionally.
Another team want to run these queries regularly and move them to graphite to which I disagree.
This query could be a start (not fine tuned)
index=_internal source=*access.log */app/* | rex "\/app\/(?<AppName>\w+)\/(?<ViewName>\w+)\"" | search AppName=* AND ViewName=* | table _time, AppName, ViewName, user
I am a Splunk admin..and the view was created by me.. but looks like when others use, I don't see it being reported.
index=internal source=access.log */app/ | rex "\/app\/(?