Monitoring Splunk

How to search usage of "view"?

hochit
Path Finder

I know I can monitor the usage of saved search by saved_search_name from _audit index. However, I can't find equivalent way to search that for view.

Any idea?

Tags (1)
1 Solution

ziegfried
Influencer

You can take a look at the splunkweb access log:

index=_internal sourcetype=splunk_web_access uri_path=*/app/<your_app>/<your_view>

Replace <your_app> and <your_view> with the app and view you want to see.

View solution in original post

ziegfried
Influencer

You can take a look at the splunkweb access log:

index=_internal sourcetype=splunk_web_access uri_path=*/app/<your_app>/<your_view>

Replace <your_app> and <your_view> with the app and view you want to see.

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...