Used reports/dashboards

[PickleRick]

I was wondering...

Can I get (probably from _internal) which reports and dashboards were executed by users? I supposed that saved searches spawned by scheduler should be possible to either find in configuration (by checking their schedule) or by tracking scheduler logs. But ad-hoc ones?

Use case is - users created many different dashboards and reports and we want to clean the ones not used anymore. But first of course we need to find them.

[somesoni2]

This app might be useful for what you're looking for (and some more):

https://splunkbase.splunk.com/app/3541/

[PickleRick]

Hmm... Seems useful. Will have to give it a try. Thanks.

[PickleRick]

After some fiddling (that's typical - I ask a question, then start looking for myself ;-)) it seems that I found a similar solution. I don't do the timecharting but just count but I approach it from a bit different side.

Instead of listing all URLs and only matching some of them. I firstly build a list of defined dashboards and then look for them in the access log.

index=_internal source="/opt/splunk/var/log/splunk/splunkd_ui_access.log" 
    [| rest /services/data/ui/views 
| where isDashboard=1
| fields title
| eval uri_path="/*/app/*/".title 
| table uri_path] 
| stats count by uri_path

But the general idea is similar. Thanks.

EDIT: Oh, and your search lists users, not the dashboards themselves. 😉

[ashvinpandey]

@PickleRick Please try the below query:

index="_internal" source=*access.log user!="-" */app/* 
| rex "\/en\-US\/app\/(?<app>\w+)\/(?<dashboard>\w+)" 
| search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home" dashboard!="alerts" dashboard!="alert" dashboard!="dashboards" dashboard!="reports" dashboard!="report" dashboard!="overview" 
| search dashboard="*"
| bucket span=1m _time 
| stats count sparkline max(_time) as lastaccess earliest(_time) as StartTime by user 
| eval avg=count/5
| convert ctime(lastaccess) ctime(StartTime) 
| sort -lastaccess 
| rename  user as "User" lastaccess as "Last accessed on" count as "No. of times accessed" avg as "Weekly Avg." StartTime as "First accessed on"

Also if this reply helped you an up vote will be appreciated