Monitoring Splunk

Used reports/dashboards

PickleRick
SplunkTrust
SplunkTrust

I was wondering...

Can I get (probably from _internal) which reports and dashboards were executed by users? I supposed that saved searches spawned by scheduler should be possible to either find in configuration (by checking their schedule) or by tracking scheduler logs. But ad-hoc ones?

Use case is - users created many different dashboards and reports and we want to clean the ones not used anymore. But first of course we need to find them.

Labels (1)
0 Karma

somesoni2
Revered Legend

This app might be useful for what you're looking for (and some more):

https://splunkbase.splunk.com/app/3541/

PickleRick
SplunkTrust
SplunkTrust

Hmm... Seems useful. Will have to give it a try. Thanks.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

After some fiddling (that's typical - I ask a question, then start looking for myself ;-)) it seems that I found a similar solution. I don't do the timecharting but just count but I approach it from a bit different side.

Instead of listing all URLs and only matching some of them. I firstly build a list of defined dashboards and then look for them in the access log.

 

index=_internal source="/opt/splunk/var/log/splunk/splunkd_ui_access.log" 
    [| rest /services/data/ui/views 
| where isDashboard=1
| fields title
| eval uri_path="/*/app/*/".title 
| table uri_path] 
| stats count by uri_path

 

 

But the general idea is similar. Thanks.

EDIT: Oh, and your search lists users, not the dashboards themselves. 😉

0 Karma

ashvinpandey
Contributor

@PickleRick Please try the below query:

index="_internal" source=*access.log user!="-" */app/* 
| rex "\/en\-US\/app\/(?<app>\w+)\/(?<dashboard>\w+)" 
| search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home" dashboard!="alerts" dashboard!="alert" dashboard!="dashboards" dashboard!="reports" dashboard!="report" dashboard!="overview" 
| search dashboard="*"
| bucket span=1m _time 
| stats count sparkline max(_time) as lastaccess earliest(_time) as StartTime by user 
| eval avg=count/5
| convert ctime(lastaccess) ctime(StartTime) 
| sort -lastaccess 
| rename  user as "User" lastaccess as "Last accessed on" count as "No. of times accessed" avg as "Weekly Avg." StartTime as "First accessed on"

Also if this reply helped you an up vote will be appreciated

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...