Monitoring Splunk

Used reports/dashboards

PickleRick
SplunkTrust
SplunkTrust

I was wondering...

Can I get (probably from _internal) which reports and dashboards were executed by users? I supposed that saved searches spawned by scheduler should be possible to either find in configuration (by checking their schedule) or by tracking scheduler logs. But ad-hoc ones?

Use case is - users created many different dashboards and reports and we want to clean the ones not used anymore. But first of course we need to find them.

Labels (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

This app might be useful for what you're looking for (and some more):

https://splunkbase.splunk.com/app/3541/

PickleRick
SplunkTrust
SplunkTrust

Hmm... Seems useful. Will have to give it a try. Thanks.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

After some fiddling (that's typical - I ask a question, then start looking for myself ;-)) it seems that I found a similar solution. I don't do the timecharting but just count but I approach it from a bit different side.

Instead of listing all URLs and only matching some of them. I firstly build a list of defined dashboards and then look for them in the access log.

 

index=_internal source="/opt/splunk/var/log/splunk/splunkd_ui_access.log" 
    [| rest /services/data/ui/views 
| where isDashboard=1
| fields title
| eval uri_path="/*/app/*/".title 
| table uri_path] 
| stats count by uri_path

 

 

But the general idea is similar. Thanks.

EDIT: Oh, and your search lists users, not the dashboards themselves. 😉

0 Karma

ashvinpandey
Contributor

@PickleRick Please try the below query:

index="_internal" source=*access.log user!="-" */app/* 
| rex "\/en\-US\/app\/(?<app>\w+)\/(?<dashboard>\w+)" 
| search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home" dashboard!="alerts" dashboard!="alert" dashboard!="dashboards" dashboard!="reports" dashboard!="report" dashboard!="overview" 
| search dashboard="*"
| bucket span=1m _time 
| stats count sparkline max(_time) as lastaccess earliest(_time) as StartTime by user 
| eval avg=count/5
| convert ctime(lastaccess) ctime(StartTime) 
| sort -lastaccess 
| rename  user as "User" lastaccess as "Last accessed on" count as "No. of times accessed" avg as "Weekly Avg." StartTime as "First accessed on"

Also if this reply helped you an up vote will be appreciated

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...