Need a query to check number of times a dashboard is accessed in splunk

[Mrig342]

Hi All,

We are trying to create a report of how many times a dashboard is being accessed in last 24 hrs in splunk. Can you please help us create a query to achieve this report.

Your kind inputs are highly appreciated..!!

Thank you..!!

[jotne]

We do use a dashboard to see the overall dashboard usage in our solution:

<form version="1.6" theme="dark">
  <label>Dashboard usage</label>
  <!--
  1.1 Added line view and host info 
  1.2 Added sort
  1.3 Added sort by in dashboard
  1.4 Fixed new forma
  1.5 Fixed dashboard regex by adding space and added Pie chart 
  1.6 Fixed missing user
  -->
  <search id="base_search">
    <query>
      index="_internal"
      "data/ui/views/"
      NOT "servicesNS/-"
      sourcetype=splunkd_ui_access
      | rex "(?&lt;app&gt;[^\/]+)\/data\/ui\/views\/(?&lt;dashboard&gt;[^? ]+)"
      | rex "servicesNS\/(?&lt;user2&gt;[^\/]+)"
      | rex mode=sed field=user2 "s/%40/@/"
      | eval user=if(user="-",user2,user)
      | search
        app=*
        host="$Host$"
        user="$User$"
        app="$App$"
        dashboard="$Dashboard$"
      | fields _time host user app dashboard
    </query>
  </search>
  <fieldset submitButton="false">
    <input type="time">
      <label>Max is 30 days back</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="Host">
      <label>Host</label>
      <search base="base_search">
        <query>
          | eval data=host
          | stats count by data
          | eval info=data." (".count.")"
          | sort -count
        </query>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>info</fieldForLabel>
      <fieldForValue>data</fieldForValue>
      <default>*</default>
    </input>
    <input type="dropdown" token="User">
      <label>User</label>
      <search base="base_search">
        <query>
          | eval data=user
          | stats count by data
          | eval info=data." (".count.")"
          | sort -count
        </query>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>info</fieldForLabel>
      <fieldForValue>data</fieldForValue>
      <default>*</default>
    </input>
    <input type="dropdown" token="App">
      <label>Application</label>
      <search base="base_search">
        <query>
          | eval data=app
          | stats count by data
          | eval info=data." (".count.")"
          | sort -count
        </query>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>info</fieldForLabel>
      <fieldForValue>data</fieldForValue>
      <default>*</default>
    </input>
    <input type="dropdown" token="Dashboard">
      <label>Dashboard</label>
      <search base="base_search">
        <query>
          | eval data=dashboard
          | stats count by data
          | eval info=data." (".count.")"
          | sort -count
        </query>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>info</fieldForLabel>
      <fieldForValue>data</fieldForValue>
      <default>*</default>
    </input>
    <input type="dropdown" token="Sort">
      <label>Graph by</label>
      <choice value="dashboard">Dashboard</choice>
      <choice value="app">Application</choice>
      <choice value="user">User</choice>
      <choice value="host">Host</choice>
      <default>dashboard</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search base="base_search">
          <query>
            | timechart limit=25 useother=f count by $Sort$
          </query>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="height">400</option>
        <option name="charting.fieldColors">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <search base="base_search">
          <query>
            | stats count by $Sort$
          </query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="height">385</option>
        <option name="charting.fieldColors">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search base="base_search">
          <query>
            | sort 0 - _time
            | table _time host user app dashboard
          </query>
        </search>
        <option name="count">50</option>
        <format type="color" field="host">
          <colorPalette type="map">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</colorPalette>
        </format>
        <format type="color" field="user">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="app">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="dashboard">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
  </row>
</form>

[ITWhisperer]

index=_internal sourcetype=splunk_web_access
| timechart count by uri_path

[Mrig342]

Hi @ITWhisperer,

Thank you for the inputs..!!

However, the above query just gives a table with time and count. We are looking to create a table with Dashboard name and count of times it is access. Something like this:

Dashboard	Count

Please help to modify the query so that we can achieve this tabular report.

Thank you very much..!!

[jotne]

This is just a part taken from my posted dashboard in this thread:

index="_internal"
 "data/ui/views/"
 NOT "servicesNS/-"
 sourcetype=splunkd_ui_access 
| rex "(?<app>[^\/]+)\/data\/ui\/views\/(?<dashboard>[^? ]+)" 
| stats count by dashboard
| sort -count

[ITWhisperer]

Do you have access to the _internal index? If not, please consult with your administrator to assign you to a role that does have access.

[Mrig342]

Hi @ITWhisperer,

We are trying to create the report only for this index "int_gcg_apac_solace_199034" and below are the sourcetypes it has: 

NON-DIGITAL_AMXBPM_INFRA_LOGS

NON-DIGITAL_CISAO_UAT2_TIBCO_RLM

NON-DIGITAL_CI_BW_INFRA_LOGS

NON-DIGITAL_ESB_BW_INFRA_LOGS

NON-DIGITAL_KAFKA_INFRA_FS

NON-DIGITAL_KAFKA_UAT

NON-DIGITAL_TIBCO_INFRA_BW

NON-DIGITAL_TIBCO_INFRA_FS

NON-DIGITAL_TIBCO_INFRA_JBPM

NON-DIGITAL_TIBCO_INFRA_WAS

NON-DIGITAL_TIBCO_SERVICE_SETTINGS

syslog:Event

Can you please help to make the query such that we can get the dashboard usage report for this index only which we have access to.

Thank you..!!

[ITWhisperer]

You will need access to the _internal index to do this, or ask you administrators to create a report  or summary index for you.