Splunk Search
Highlighted

How can I view when the last data imports were?

Path Finder

I have a dashboard that lists/groups recently updated dashboards and I just wanted to know if there was a way to also add another column to view and search the last data imports of those dashboards.

For an example one of the dashboards last Data import was 05/08/2017 ( see photo below)
alt text

So since my dashboard lists the other dashboards my team has made, is there a way to show when those dashboards had the last import?
My requested format would be:

Dashboard, Timestamp,& Last Data Import Date.

Hopefully this all makes sense. Please let me know if it doesn't. Thank you.

0 Karma
Highlighted

Re: How can I view when the last data imports were?

SplunkTrust
SplunkTrust

Could you provide more information like your current query (which I assume showing "dashboard has last import") and/or sample events. Do other dashboard use the same/similar query?

0 Karma
Highlighted

Re: How can I view when the last data imports were?

Path Finder

As of right now my query shows the most recent dashboard being updated, the time of the updates, the app name and the user updating it.

      <query>index=_internal source=*web_access.log* /app/ action=edit | rex "/app/(?&lt;app_name&gt;.\w+)/(?&lt;dashboard_name&gt;.\w+)" | table dashboard_name, _time, app_name, user</query>

What I want is to also show the last data imports too. The other dashboards use the same query, yes.

0 Karma
Highlighted

Re: How can I view when the last data imports were?

SplunkTrust
SplunkTrust

what do you mean by import?
do you mean the last event that has been calculated in the panels?
if that is the case, run the same search that populates panel and then ... | head 1 | table _time

0 Karma
Highlighted

Re: How can I view when the last data imports were?

Path Finder

Yea that's exactly what I mean. The last event that's been calculated in the panels.

0 Karma
Highlighted

Re: How can I view when the last data imports were?

SplunkTrust
SplunkTrust

have to say that i think its a weird requirement. i think you try and add to each search something like:
... | stats latest(_time) as lastTime | eval lastEventTime=strftime(lastTime, "%F %H:%M:%S")

now you have the last event time f the search

Highlighted

Re: How can I view when the last data imports were?

SplunkTrust
SplunkTrust

If you can distinguish the kind of imports from data that is in the index, then I'd use the value of recentTime in the metadata for the index.

| metadata index=indexname  (then more stuff depending on what you need)

Here's some useful answers with specific metadata searches...

https://answers.splunk.com/answers/7471/difference-between-lasttime-and-recenttime-in-metadata-outpu...
https://answers.splunk.com/answers/148216/how-metadata-host-by-index-and-sourcetype-recenttime.html

0 Karma