Splunk Search

How to create a dashboard that lists recently updated dashboards?

eyaluodba
Path Finder

my team has a lot of dashboards and I want to create a simple code for another one that groups and lists some of the dashboards that have been recently updated.

And if so when I search up these updated databases I would like to know the indexes and dataset that these dashboards have.

Requested Table format Dashboard Name, Index, Timestamp (Shows when the dashboard was last updated)

Here is the code I have so far. Now sure how to do the rest.

    <title>Dashboard Search</title>
    <search id="base"> 
      <query>index=_internal  | table  DashboardName Index Timestamp </query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
0 Karma
1 Solution

vasanthmss
Motivator

Use the below search to get the views that are edited,

index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name
V

View solution in original post

vasanthmss
Motivator

Use the below search to get the views that are edited,

index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name
V

eyaluodba
Path Finder

I get a "Error on line 2: Unexpected close tag

    <search id="base"> 
      <query> index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name </query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
0 Karma

adonio
Ultra Champion

try this:

<dashboard>
  <label>Changed Views</label>
  <row>
    <panel>
      <title>who changed what when</title>
      <table>
        <search>
          <query>index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?&lt;app_name&gt;.\w+)/(?&lt;dashboard_name&gt;.\w+)" | table _time, user, app_name dashboard_name</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

eyaluodba
Path Finder

Anyway I can also see the indexes?

0 Karma

adonio
Ultra Champion

do you mean the indexes a search / report / dashboard is using?

0 Karma

eyaluodba
Path Finder

Yes, like is there a way I can also add a new column to show the indexes that those databases are using?

0 Karma

adonio
Ultra Champion

@eyaluodba this data is a little more complex to grab as you will need to look at the search.log (in _internal and _audit indexes). it will require couple of steps process.
a. understand and capture which searches drives your views and who is the creator (will elaborate)
b. what is the syntax of the searches and if it has: index=a OR index=b etc...
c. understand the results and the indexes field values
d. if the role does not have access to indexes, the search will skip these particular indexes although the search syntax includes them
e. with that said, there are couple of answers here that covers some of it:
https://answers.splunk.com/answers/321581/how-to-find-the-most-searched-index-in-splunk.html
https://answers.splunk.com/answers/273176/how-can-i-determine-how-much-an-index-is-being-sea.html

eyaluodba
Path Finder

It wants me to put it up first, but when I do it doesn't work.

index=_internal source=web_access.log /app/ action=edit
| rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table dashboard_name, _time, app_name, user,

0 Karma

adonio
Ultra Champion

i think it will be good to open another question.
pay attention that the | rest /services/data/indexes only tells you about the indexes configurations and not about how they are being searched

eyaluodba
Path Finder

Alright thanks for all your help!

0 Karma

eyaluodba
Path Finder

So if I wanted to use | REST /services/data/indexes | table title
in my code, how would I go about doing that? Everytime I try to add it I get "Error in 'rest' command: This command must be the first command of a search."

0 Karma

eyaluodba
Path Finder

Thank you so much!

0 Karma

eyaluodba
Path Finder

Thank you so much. It worked!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...