Splunk Search

Dashboard views by user using REST & index=_internal

mgianola
Explorer

I'd like to search dashboard views by user, which is stored in index=_internal. REST allows me to limit results using the isDashboard = 1 parameter. Is there a way to join this REST call to index=_internal so I can see dashboard usage without explicitly having to list or exclude dashboard objects in index=_internal?

index=_internal sourcetype=splunk_web_access
| join title type=inner [rest /servicesNS/-/-/data/ui/views | search isDashboard=1 isVisible=1] 
| stats count by app, view, user
0 Karma
1 Solution

mgianola
Explorer

Looks like this can be solved using rex:

index=_internal sourcetype=splunk_web_access
| rex field=uri_path ".*/(?<title>[^/]*)$"
| join title [rest /servicesNS/-/-/data/ui/views 
| search isDashboard=1 isVisible=1
| stats count by app, view, user

View solution in original post

0 Karma

mgianola
Explorer

Looks like this can be solved using rex:

index=_internal sourcetype=splunk_web_access
| rex field=uri_path ".*/(?<title>[^/]*)$"
| join title [rest /servicesNS/-/-/data/ui/views 
| search isDashboard=1 isVisible=1
| stats count by app, view, user
0 Karma

jagadeeshm
Contributor

I don't think this is working anymore!

0 Karma

althomas
Communicator

No, it looks like all the fields got updated. Here's a version that works for me:

index=_internal sourcetype=splunk_web_access host=<SEARCH HEAD> user=<USER> 
| rex field=uri_path ".*/(?<title>[^/]*)$" 
| join title app
    [| rest /servicesNS/-/-/data/ui/views splunk_server=local
    | search isDashboard=1 isVisible=1 
    | rename eai:acl.app as app 
    | stats count by title app 
    | fields - count ]
| table _time user title app
0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...