Splunk Search

How do I create a search that shows which Savedsearches were used in Dashboard?

Sanz
Explorer

Hi I'm new to Splunk and what to create a search that shows what savedsearches where used in a dashboard?

This is how far I got:

| rest /servicesNS/-/-/data/ui/views  splunk_server=local
| search title="test_dashboard"
| rename eai:acl.app AS app, eai:data AS data
| fields title app author data



I have no clue how to go from this data to an actual list of savedsearches used in this dashboard.
Is there anyone who can put me on a good track?

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

| rest /servicesNS/-/-/data/ui/views  splunk_server=local
| search title="test_dashboard"
| rename eai:acl.app AS app, eai:data AS data
| fields title app author data
|  where match(data,"\|\s*savedsearch\s") OR match(data,"ds\.savedSearch") OR match(data,"search ref\=") 
|  rex field=data "\|\s+savedsearch\s+(?<savedsearch1>\S+)" 
|  rex field=data "(\s|\")ref((\":)|\=)\s*\"(?<savedsearch2>[^\"]+)" 
| eval savedsearch=coalesce(savedsearch1, savedsearch2)
| stats count by savedsearch | fields - count

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

| rest /servicesNS/-/-/data/ui/views  splunk_server=local
| search title="test_dashboard"
| rename eai:acl.app AS app, eai:data AS data
| fields title app author data
|  where match(data,"\|\s*savedsearch\s") OR match(data,"ds\.savedSearch") OR match(data,"search ref\=") 
|  rex field=data "\|\s+savedsearch\s+(?<savedsearch1>\S+)" 
|  rex field=data "(\s|\")ref((\":)|\=)\s*\"(?<savedsearch2>[^\"]+)" 

Sanz
Explorer

@somesoni2 Thanks a lot for you reply! This works like a charm.

Question though: 

How can I loop the results as list into 1 field maybe as list?

Something like this (I mixed python and SPL haha)

data[] = results from | where match(data,"\|\s*savedsearch\s") OR match(data,"ds\.savedSearch") OR match(data,"search ref\=")

for x in data:
print(x) in field "savedsearch"

0 Karma

somesoni2
Revered Legend

Try this

| rest /servicesNS/-/-/data/ui/views  splunk_server=local
| search title="test_dashboard"
| rename eai:acl.app AS app, eai:data AS data
| fields title app author data
|  where match(data,"\|\s*savedsearch\s") OR match(data,"ds\.savedSearch") OR match(data,"search ref\=") 
|  rex field=data "\|\s+savedsearch\s+(?<savedsearch1>\S+)" 
|  rex field=data "(\s|\")ref((\":)|\=)\s*\"(?<savedsearch2>[^\"]+)" 
| eval savedsearch=coalesce(savedsearch1, savedsearch2)
| stats count by savedsearch | fields - count
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...