Splunk Enterprise

List all the dashboards using specific metrics index

BEN_
Engager

I would like to find a way to list the dependency between dashboards and indexes.

I'm using the following query to get the list of all the Dashboards using the index Oracle which is an event Index.

 

 

 

 

 

 

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views"
| search "eai:data"="*index=oracle*"
| eval Type="Dashboards"
| table Type title eai:acl.app author eai:acl.perms.read

 

 

 

 

 

 

This query is working fine but not for Metrics index.

Am I missing something ?

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

There is no good reason why it would not find it if it is present. You should be able to figure out the issue by just finding a single dashboard you know has that expression and running this

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" 
| search title="xyz"
| eval match=if(match('eai:data', "(?i)index=murex_metrics", 1, 0)
| table match eai:data

replace xyz with your dashboard title and then you will have two columns match and eai:data - match will be 1 or 0 depending if found and you should be able to do a visual check on the data

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your search= statement is simply looking for that index=oracle somewhere in the dashboard. If you have index="oracle" or index = oracle then it won't match, so it may be better to do a regex where clause, where you do

...
| where match('eai:data', "(?i)index\s*(=[\s\"]*|in\s+\([\w,]*)oracle")

what is an example of a metrics index search that is not showing up?

 

0 Karma

BEN_
Engager

Thank you for your response. I'm using explicitly the index="oracle" as an example to confirm when the search works fine for an index event. When I use the same search for Metrics index (replacing index="oracle" by index="murex_metrics")   it doesn't work knowing that we have existent dashboards using this metrics index.

here the  example of a metrics index search

 

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" 
| search "eai:data"="*index=murex_metrics*" 

 

 thanks

0 Karma

bowesmana
SplunkTrust
SplunkTrust

There is no good reason why it would not find it if it is present. You should be able to figure out the issue by just finding a single dashboard you know has that expression and running this

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" 
| search title="xyz"
| eval match=if(match('eai:data', "(?i)index=murex_metrics", 1, 0)
| table match eai:data

replace xyz with your dashboard title and then you will have two columns match and eai:data - match will be 1 or 0 depending if found and you should be able to do a visual check on the data

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@BEN_ - While this covers much of what you are trying to find. It's important to keep in mind that this would not cover all the scenarios. Some example queries would not be covered by the query.

  • index IN (murex_metrics)
  • index=*
  • index=murex*
  • etc

 

0 Karma

BEN_
Engager

Hi bowesmana,

Yes you are right. The query is working fine for both event and Metrics indexes. the problem was at level of the search filter.

I found that the search in the dashboard contains ""  {... WHERE "index"="murex_metrics" AND ... } this explains why the filter in my search "eai:data"="*index=murex_metrics*" didn't return any data.

Thanks again

 

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...