Splunk Search

Dashboard views by user using REST & index=_internal

mgianola
Explorer

I'd like to search dashboard views by user, which is stored in index=_internal. REST allows me to limit results using the isDashboard = 1 parameter. Is there a way to join this REST call to index=_internal so I can see dashboard usage without explicitly having to list or exclude dashboard objects in index=_internal?

index=_internal sourcetype=splunk_web_access
| join title type=inner [rest /servicesNS/-/-/data/ui/views | search isDashboard=1 isVisible=1] 
| stats count by app, view, user
0 Karma
1 Solution

mgianola
Explorer

Looks like this can be solved using rex:

index=_internal sourcetype=splunk_web_access
| rex field=uri_path ".*/(?<title>[^/]*)$"
| join title [rest /servicesNS/-/-/data/ui/views 
| search isDashboard=1 isVisible=1
| stats count by app, view, user

View solution in original post

0 Karma

mgianola
Explorer

Looks like this can be solved using rex:

index=_internal sourcetype=splunk_web_access
| rex field=uri_path ".*/(?<title>[^/]*)$"
| join title [rest /servicesNS/-/-/data/ui/views 
| search isDashboard=1 isVisible=1
| stats count by app, view, user
0 Karma

jagadeeshm
Contributor

I don't think this is working anymore!

0 Karma

althomas
Communicator

No, it looks like all the fields got updated. Here's a version that works for me:

index=_internal sourcetype=splunk_web_access host=<SEARCH HEAD> user=<USER> 
| rex field=uri_path ".*/(?<title>[^/]*)$" 
| join title app
    [| rest /servicesNS/-/-/data/ui/views splunk_server=local
    | search isDashboard=1 isVisible=1 
    | rename eai:acl.app as app 
    | stats count by title app 
    | fields - count ]
| table _time user title app
0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...