Knowledge Management

Can we do: search $dashboard_id$ = 'my_dashboard'?

SplnkUse
Path Finder

Hello

 

Is it possible to run the search of a dashboard by using its ID?

 

Also, can I add fields to the search above? I.e. if a dashboard conducts this search:

(index="mysource" earliest=-264h latest=now())
| eval metric=case(index="mysource", '_time')
...

 

Can I do something like:

search $dashboard_id$ = 'my_dashboard'

| eval Timestamp=strftime(now(),"%d/%m/%Y %H:%M:00")
| table A1 A2  Timestamp

 

I.e. append additional code?

 

Thanks!

Labels (1)
0 Karma

SplnkUse
Path Finder

@richgalloway  thanks but can you give me an example please? What are the steps from the below to create a search to always link to a dashboard?

 

SplnkUse_0-1635453564374.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Edit the dashboard then click the Source button to view the XML.  Use the examples in the link above as a guide to create a base search and then turn the later search into a post-processing search (by using the 'base=' option to refer to the base search).

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplnkUse
Path Finder

@richgalloway  mm unfortunately it does not work. I am not the author of the dashboard that's why I am struggling.

If I click to Edit the dashboard, it only offers to either Clone it or make it a Home Dashboard.

I clicked to Clone and then checked the source and it is completely empty.

 

Is there a way to create a search by the $dashboard.label$ of the dashboard and can you provide a sample syntax please? Without knowing its source/XML or being able to edit it? I only want to run it periodically to get alerts.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry, my answers assume you own the dashboard in question.  If you're not the owner then cloning the dashboard should have worked.  I don't understand why a working dashboard would clone into something completely empty.

If you have the right permissions then a REST query may help.

| rest /services/data/ui/views/<<name of the dashboard>>
| table title data
---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplnkUse
Path Finder

@richgalloway  thanks but is there a way to check if I have Rest access? I am only a user not a dev. Also, can you provide please the complete syntax based on my main url? I tried some starting uris but they resulted in 404. My main url is https://mysite.splunkcloud.com/en-US/app/myapp/mydashboard

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you run a REST command and it works then you have access.  Contact your Splunk admin to check or to get access.

The complete syntax is in the answer above.  If you also need the CLI command try this:

curl -k https://mysite.splunkcloud.com/services/data/ui/views/mydashboard
---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplnkUse
Path Finder

@richgalloway  thanks, I tried that, visiting the url above leads to an Oops not found page and via curl it says 303 error. Does that mean I do not have API access?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I 'm not sure, but I it may be because you don't have access.  Check the internal logs (or have your admin do it) to see if there's an explanation there.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can accomplish the same goal by using a base search and post-processing.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/Savedsearches#Post-process_searches

---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>