How to show usage of Apps and dashboards by User?

[abhi41]

Hi All,

I am looking for some dashboards showing the usage of Apps and it's dashboards by User so that I can decommission unused Apps. The below solution is only extracting very partial information like 15%.

Solved: See User Activity by App and View - Splunk Community

Can someone please help.

Regards,

Devang

@tnesavich_splun 

[_JP]

In a pretty fresh 9.1.1 Splunk install (only Dashboard Examples has been added), if I tried to run the search in the Accepted Solution you linked to I wasn't getting any results because the app and view fields weren't getting extracted in the Search app context in Verbose Mode.  Not sure if something has changed in the field extractions on _internal since that was posted in 2019.

If I add a rex command to force the field extract, it seems to be picking up all of the hits to splunkweb to track app usage:

index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-
| rex field=uri_path "\/app\/(?<app>[^\/]+)\/(?<view>[^\/\s]+)"
| stats count latest(_time) as ViewTime by user app view
    | sort -count
    | eventstats sum(count) as countByApp list(view) as view list(count) as count list(ViewTime) as ViewTime by user app
    | convert timeformat="%a %m/%d/%Y %I:%M:%S %p" ctime(ViewTime)
    | dedup app
    | appendpipe [stats sum(count) as count by user | eval view = "Total Views"]
    | sort + user -countByApp

Note:  There are other things happening in splunkweb that you don't have to count - images fetches, calls to the manager endpoints, etc. You can see them here:

index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-
| rex field=uri_path "\/app\/(?<app>[^\/]+)\/(?<view>[^\/\s]+)"
| search NOT app=*