List all the dashboards using specific metrics index

[BEN_]

I would like to find a way to list the dependency between dashboards and indexes.

I'm using the following query to get the list of all the Dashboards using the index Oracle which is an event Index.

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views"
| search "eai:data"="*index=oracle*"
| eval Type="Dashboards"
| table Type title eai:acl.app author eai:acl.perms.read

This query is working fine but not for Metrics index.

Am I missing something ?

[bowesmana]

Your search= statement is simply looking for that index=oracle somewhere in the dashboard. If you have index="oracle" or index = oracle then it won't match, so it may be better to do a regex where clause, where you do

...
| where match('eai:data', "(?i)index\s*(=[\s\"]*|in\s+\([\w,]*)oracle")

what is an example of a metrics index search that is not showing up?

[BEN_]

Thank you for your response. I'm using explicitly the index="oracle" as an example to confirm when the search works fine for an index event. When I use the same search for Metrics index (replacing index="oracle" by index="murex_metrics")   it doesn't work knowing that we have existent dashboards using this metrics index.

here the  example of a metrics index search

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" 
| search "eai:data"="*index=murex_metrics*" 

 thanks

[bowesmana · Accepted solution]

There is no good reason why it would not find it if it is present. You should be able to figure out the issue by just finding a single dashboard you know has that expression and running this

| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" 
| search title="xyz"
| eval match=if(match('eai:data', "(?i)index=murex_metrics", 1, 0)
| table match eai:data

replace xyz with your dashboard title and then you will have two columns match and eai:data - match will be 1 or 0 depending if found and you should be able to do a visual check on the data

[VatsalJagani]

@BEN_ - While this covers much of what you are trying to find. It's important to keep in mind that this would not cover all the scenarios. Some example queries would not be covered by the query.

• index IN (murex_metrics)
• index=*
• index=murex*
• etc

[BEN_]

Hi bowesmana,

Yes you are right. The query is working fine for both event and Metrics indexes. the problem was at level of the search filter.

I found that the search in the dashboard contains ""  {... WHERE "index"="murex_metrics" AND ... } this explains why the filter in my search "eai:data"="*index=murex_metrics*" didn't return any data.

Thanks again