find last time dashboard run

[sarit_s]

Hello

is it possible to get a list of all the dashboards that was running for the last * days ?

[isoutamo]

Yes it's possible. You can start with this query, if you have access to _audit log.

index=_audit user!=splunk-system-user app=* provenance="*" 
| stats last(_time) as _time count values(provenance) as Dashboard by app

r. Ismo 

[sarit_s]

thanks, it looks good but i need the last time of each dashboard and not grouped by app

[isoutamo]

Like this?

index=_audit user!=splunk-system-user app=* provenance="*" 
| stats last(_time) as _time count by provenance
| rename provenance as Dashboard

r. Ismo 

[sarit_s]

thanks

is it possible to add the user to this list ?

[isoutamo]

index=_audit user!=splunk-system-user app=* provenance="*" 
| stats last(_time) as _time values(user) as users count by provenance
| rename provenance as Dashboard

If you haven't enough user experience about Splunk and SPL there are lot of trainings available. Some free and other payable. You can found Splunk's own training offerings from https://education.splunk.com/catalog

There is also lot of other training / learning material on other sites including YouTube.

r. Ismo