Splunk Enterprise

Dashboard

nnesje
Loves-to-Learn

How can I identify which Dashboards contain a specific saved search?

Labels (1)
Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@nnesje 

 

You can use rest command to find specific savedsearch used in any dashboard. Try this one,

 

 

|rest /servicesNS/admin/search/data/ui/views 
| fields  "eai:data" "eai:acl.app" label id 
| where like('eai:data',"%<<YOUR_SS_NAME>>%")
| table "eai:acl.app" label id

 

 

Replace  <<YOUR_SS_NAME>> with your savedsearch name. 

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.