Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor?

[deepikagooty]

Hi,

I would like to show the numbers of users and also the number of unique users visiting a particular dashboard. I want to display these numbers somewhere on the dashboard. I have multiple dashboards and would like to do the same for all the dashboards.

Is there an in-built feature/tool in Splunk that does this? or Is using JavaScript a better option for this?

[impurush]

Hi, @deepikagooty,

You can use the below query to get the number of unique users who accessed the dashboard. You can embed this in your dashboard

index=_internal source=*splunkd_ui_access.log uri_path="*/<dashboard_url_name>" NOT user="-"
|stats dc(user)

Thanks,
Purush

User Monitoring for Splunk - https://splunkbase.splunk.com/app/5484/

[datsplunk4272]

Yes, @richgalloway is right!

As our Search Heads are configured with RSA authentication, I created and monitored a local index in Search Head to track the JSON file for each user in SPL.

$SPLUNK_HOME$/etc/app/<app_name(default: radius_auth>>local/user_info/<hash>.json

[deepikagooty]

Could you please elaborate on this. Thank you.

[datsplunk4272]

Here is what I could have a summary:

1. Splunk authentication (I call local settings) and all local users' login/password are stored at  $SPLUNK_HOME$/etc/passwd file. After users login, their profiles will be located $SPLUNK_HOME$/etc/users/ directory.

2. This is a way that I use to manage the users because I am using radius authentication as mentioned above. I listed the links to download and configure below that I followed so you could do your lab.

After completing the app installation and configuration, logging to SH > Click Settings > Add Data > Files & Directories ($SPLUNK_HOME$/etc/apps/radius_auth/local/user_info directory that will be monitored > follow the rest of the basic process.

Download app: https://splunkbase.splunk.com/app/981/

Configuration the radius access: https://lukemurphey.net/projects/splunk-radius-auth/wiki/Install_and_Configuration

(I could not show you my system snapshot because it is not the lab but if you have one, you could share it.)

[richgalloway · Accepted solution]

There is no built-in feature that does that.  You'll have to search and parse the splunkd_ui_access log for that information.

[deepikagooty]

Thanks for the reply @richgalloway  The splunkd_ui_access log that I have only shows my activity. Is it because it is on my local machine? If this is deployed on to the production server, Will I be able to get information of all the users accessing that dashboard with the same splunkd_ui_access log file? Please let me know. Thank you.

[richgalloway]

Since you are the only user (presumably) of your machine only your activity will be in the logs.  In a shared environment, the logs will show the activity of all users.