Other Usage

Need a query to check number of times a dashboard is accessed in splunk

Mrig342
Contributor

Hi All,

We are trying to create a report of how many times a dashboard is being accessed in last 24 hrs in splunk. Can you please help us create a query to achieve this report.

Your kind inputs are highly appreciated..!!

 

Thank you..!!

Labels (1)
0 Karma

jotne
Builder

We do use a dashboard to see the overall dashboard usage in our solution:

<form version="1.6" theme="dark">
  <label>Dashboard usage</label>
  <!--
  1.1 Added line view and host info 
  1.2 Added sort
  1.3 Added sort by in dashboard
  1.4 Fixed new forma
  1.5 Fixed dashboard regex by adding space and added Pie chart 
  1.6 Fixed missing user
  -->
  <search id="base_search">
    <query>
      index="_internal"
      "data/ui/views/"
      NOT "servicesNS/-"
      sourcetype=splunkd_ui_access
      | rex "(?&lt;app&gt;[^\/]+)\/data\/ui\/views\/(?&lt;dashboard&gt;[^? ]+)"
      | rex "servicesNS\/(?&lt;user2&gt;[^\/]+)"
      | rex mode=sed field=user2 "s/%40/@/"
      | eval user=if(user="-",user2,user)
      | search
        app=*
        host="$Host$"
        user="$User$"
        app="$App$"
        dashboard="$Dashboard$"
      | fields _time host user app dashboard
    </query>
  </search>
  <fieldset submitButton="false">
    <input type="time">
      <label>Max is 30 days back</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="Host">
      <label>Host</label>
      <search base="base_search">
        <query>
          | eval data=host
          | stats count by data
          | eval info=data." (".count.")"
          | sort -count
        </query>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>info</fieldForLabel>
      <fieldForValue>data</fieldForValue>
      <default>*</default>
    </input>
    <input type="dropdown" token="User">
      <label>User</label>
      <search base="base_search">
        <query>
          | eval data=user
          | stats count by data
          | eval info=data." (".count.")"
          | sort -count
        </query>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>info</fieldForLabel>
      <fieldForValue>data</fieldForValue>
      <default>*</default>
    </input>
    <input type="dropdown" token="App">
      <label>Application</label>
      <search base="base_search">
        <query>
          | eval data=app
          | stats count by data
          | eval info=data." (".count.")"
          | sort -count
        </query>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>info</fieldForLabel>
      <fieldForValue>data</fieldForValue>
      <default>*</default>
    </input>
    <input type="dropdown" token="Dashboard">
      <label>Dashboard</label>
      <search base="base_search">
        <query>
          | eval data=dashboard
          | stats count by data
          | eval info=data." (".count.")"
          | sort -count
        </query>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>info</fieldForLabel>
      <fieldForValue>data</fieldForValue>
      <default>*</default>
    </input>
    <input type="dropdown" token="Sort">
      <label>Graph by</label>
      <choice value="dashboard">Dashboard</choice>
      <choice value="app">Application</choice>
      <choice value="user">User</choice>
      <choice value="host">Host</choice>
      <default>dashboard</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search base="base_search">
          <query>
            | timechart limit=25 useother=f count by $Sort$
          </query>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="height">400</option>
        <option name="charting.fieldColors">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <search base="base_search">
          <query>
            | stats count by $Sort$
          </query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="height">385</option>
        <option name="charting.fieldColors">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search base="base_search">
          <query>
            | sort 0 - _time
            | table _time host user app dashboard
          </query>
        </search>
        <option name="count">50</option>
        <format type="color" field="host">
          <colorPalette type="map">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</colorPalette>
        </format>
        <format type="color" field="user">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="app">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="dashboard">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
  </row>
</form>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=_internal sourcetype=splunk_web_access
| timechart count by uri_path

Mrig342
Contributor

Hi @ITWhisperer,

Thank you for the inputs..!!

However, the above query just gives a table with time and count. We are looking to create a table with Dashboard name and count of times it is access. Something like this:

DashboardCount
  

 

Please help to modify the query so that we can achieve this tabular report.

Thank you very much..!!

0 Karma

jotne
Builder

This is just a part taken from my posted dashboard in this thread:

 

index="_internal"
 "data/ui/views/"
 NOT "servicesNS/-"
 sourcetype=splunkd_ui_access 
| rex "(?<app>[^\/]+)\/data\/ui\/views\/(?<dashboard>[^? ]+)" 
| stats count by dashboard
| sort -count

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you have access to the _internal index? If not, please consult with your administrator to assign you to a role that does have access.

0 Karma

Mrig342
Contributor

Hi @ITWhisperer,

We are trying to create the report only for this index "int_gcg_apac_solace_199034" and below are the sourcetypes it has: 

NON-DIGITAL_AMXBPM_INFRA_LOGS
NON-DIGITAL_CISAO_UAT2_TIBCO_RLM
NON-DIGITAL_CI_BW_INFRA_LOGS
NON-DIGITAL_ESB_BW_INFRA_LOGS
NON-DIGITAL_KAFKA_INFRA_FS
NON-DIGITAL_KAFKA_UAT
NON-DIGITAL_TIBCO_INFRA_BW
NON-DIGITAL_TIBCO_INFRA_FS
NON-DIGITAL_TIBCO_INFRA_JBPM
NON-DIGITAL_TIBCO_INFRA_WAS
NON-DIGITAL_TIBCO_SERVICE_SETTINGS
syslog:Event

 

Can you please help to make the query such that we can get the dashboard usage report for this index only which we have access to.

Thank you..!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You will need access to the _internal index to do this, or ask you administrators to create a report  or summary index for you.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...