Splunk Search

How to create a dashboard that lists recently updated dashboards?

eyaluodba
Path Finder

my team has a lot of dashboards and I want to create a simple code for another one that groups and lists some of the dashboards that have been recently updated.

And if so when I search up these updated databases I would like to know the indexes and dataset that these dashboards have.

Requested Table format Dashboard Name, Index, Timestamp (Shows when the dashboard was last updated)

Here is the code I have so far. Now sure how to do the rest.

    <title>Dashboard Search</title>
    <search id="base"> 
      <query>index=_internal  | table  DashboardName Index Timestamp </query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
0 Karma
1 Solution

vasanthmss
Motivator

Use the below search to get the views that are edited,

index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name
V

View solution in original post

vasanthmss
Motivator

Use the below search to get the views that are edited,

index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name
V

eyaluodba
Path Finder

I get a "Error on line 2: Unexpected close tag

    <search id="base"> 
      <query> index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name </query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
0 Karma

adonio
Ultra Champion

try this:

<dashboard>
  <label>Changed Views</label>
  <row>
    <panel>
      <title>who changed what when</title>
      <table>
        <search>
          <query>index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?&lt;app_name&gt;.\w+)/(?&lt;dashboard_name&gt;.\w+)" | table _time, user, app_name dashboard_name</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

eyaluodba
Path Finder

Anyway I can also see the indexes?

0 Karma

adonio
Ultra Champion

do you mean the indexes a search / report / dashboard is using?

0 Karma

eyaluodba
Path Finder

Yes, like is there a way I can also add a new column to show the indexes that those databases are using?

0 Karma

adonio
Ultra Champion

@eyaluodba this data is a little more complex to grab as you will need to look at the search.log (in _internal and _audit indexes). it will require couple of steps process.
a. understand and capture which searches drives your views and who is the creator (will elaborate)
b. what is the syntax of the searches and if it has: index=a OR index=b etc...
c. understand the results and the indexes field values
d. if the role does not have access to indexes, the search will skip these particular indexes although the search syntax includes them
e. with that said, there are couple of answers here that covers some of it:
https://answers.splunk.com/answers/321581/how-to-find-the-most-searched-index-in-splunk.html
https://answers.splunk.com/answers/273176/how-can-i-determine-how-much-an-index-is-being-sea.html

eyaluodba
Path Finder

It wants me to put it up first, but when I do it doesn't work.

index=_internal source=web_access.log /app/ action=edit
| rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table dashboard_name, _time, app_name, user,

0 Karma

adonio
Ultra Champion

i think it will be good to open another question.
pay attention that the | rest /services/data/indexes only tells you about the indexes configurations and not about how they are being searched

eyaluodba
Path Finder

Alright thanks for all your help!

0 Karma

eyaluodba
Path Finder

So if I wanted to use | REST /services/data/indexes | table title
in my code, how would I go about doing that? Everytime I try to add it I get "Error in 'rest' command: This command must be the first command of a search."

0 Karma

eyaluodba
Path Finder

Thank you so much!

0 Karma

eyaluodba
Path Finder

Thank you so much. It worked!

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...