Dashboards & Visualizations

search to know when a new dashboard or report is created

Champion

Hi,

Is there a search that can identify when a new scheduled search, report, or dashboard is created? Is it possible by user?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

While there's no feature for this available out-of-the-box, it's quite simple to build your own. I'll use scheduled searches as an example, other objects work in a similar fashion.

First, you'll want to find out what scheduled searches exist - query the relevant REST endpoint for that. Sadly, that doesn't tell you when an object was created, so you'll have to maintain that state yourself in a lookup (http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/ for some background)... so you create a lookup scheduled_searches or whatever. Then you schedule a search merging the lookup with the REST output to update the lookup, and alert whenever something new is added. It'll consider an old search that just had its scheduling enabled as alert-worthy.

The search then looks like this (broken into lines for structure):

| rest /servicesNS/-/-/saved/searches search="is_scheduled=1" | fields title author eai:acl.app
| eval rest = 1 | inputlookup append=t saved_searches | stats first(author) as author first(first_seen) as first_seen first(rest) as rest by title eai:acl.app | where rest==1 | fields - rest
| eval first_seen = coalesce(first_seen, now()) | outputlookup saved_searches | where first_seen==now()

Note, it's best to run this as admin - then you get the most visibility and catch all the scheduled searches. Schedule the alert as often as you want.

View solution in original post

SplunkTrust
SplunkTrust

While there's no feature for this available out-of-the-box, it's quite simple to build your own. I'll use scheduled searches as an example, other objects work in a similar fashion.

First, you'll want to find out what scheduled searches exist - query the relevant REST endpoint for that. Sadly, that doesn't tell you when an object was created, so you'll have to maintain that state yourself in a lookup (http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/ for some background)... so you create a lookup scheduled_searches or whatever. Then you schedule a search merging the lookup with the REST output to update the lookup, and alert whenever something new is added. It'll consider an old search that just had its scheduling enabled as alert-worthy.

The search then looks like this (broken into lines for structure):

| rest /servicesNS/-/-/saved/searches search="is_scheduled=1" | fields title author eai:acl.app
| eval rest = 1 | inputlookup append=t saved_searches | stats first(author) as author first(first_seen) as first_seen first(rest) as rest by title eai:acl.app | where rest==1 | fields - rest
| eval first_seen = coalesce(first_seen, now()) | outputlookup saved_searches | where first_seen==now()

Note, it's best to run this as admin - then you get the most visibility and catch all the scheduled searches. Schedule the alert as often as you want.

View solution in original post

Communicator

How would you convert the first_seen to a date/time stamp that management can read.

I was thinking of using convert ctime(firstseen) right after the stats command like so
| rest /servicesNS/-/-/saved/searches search="is
scheduled=*"
| rename eai:acl.app as app, title as dashboard
| fields dashboard visible author app updated
| eval rest = 1
| inputlookup append=t dashboardoutput.csv
| stats first(author) as author first(first
seen) as firstseen first(rest) as rest by dashboard app
| convert ctime(first
seen)
| where rest==1
| fields - rest
| eval firstseen = coalesce(firstseen, now())
| outputlookup dashboardoutput.csv
| where first
seen==now()

0 Karma

SplunkTrust
SplunkTrust

An additional thought, consider how you want to handle disabled searches. Do you want to be alerted when someone enables an old scheduled search? If so, add disabled=0 to the search attribute of the rest command.

0 Karma

Champion

Fantastic. Thanks!

0 Karma