Dashboard views by user using REST & index=_internal

[mgianola]

I'd like to search dashboard views by user, which is stored in index=_internal. REST allows me to limit results using the isDashboard = 1 parameter. Is there a way to join this REST call to index=_internal so I can see dashboard usage without explicitly having to list or exclude dashboard objects in index=_internal?

index=_internal sourcetype=splunk_web_access
| join title type=inner [rest /servicesNS/-/-/data/ui/views | search isDashboard=1 isVisible=1] 
| stats count by app, view, user

[mgianola · Accepted solution]

Looks like this can be solved using rex:

index=_internal sourcetype=splunk_web_access
| rex field=uri_path ".*/(?<title>[^/]*)$"
| join title [rest /servicesNS/-/-/data/ui/views 
| search isDashboard=1 isVisible=1
| stats count by app, view, user

[jagadeeshm]

I don't think this is working anymore!

[althomas]

No, it looks like all the fields got updated. Here's a version that works for me:

index=_internal sourcetype=splunk_web_access host=<SEARCH HEAD> user=<USER> 
| rex field=uri_path ".*/(?<title>[^/]*)$" 
| join title app
    [| rest /servicesNS/-/-/data/ui/views splunk_server=local
    | search isDashboard=1 isVisible=1 
    | rename eai:acl.app as app 
    | stats count by title app 
    | fields - count ]
| table _time user title app