Splunk Search

How to find out the list of dashboards triggering more than 5 searches

orca
Explorer

I would like to find out dashboards which are not optimized and each panel is triggering the independent search and consuming all resources. 

Is there a splunk search to identify the dashboard so that I can educate the users to use post process searches and optimize the dashboard and resource consumptions.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

index=_audit savedsearch_name=search* 
| rex field=savedsearch_name "search(?<Count>\d+)" 
| where Count > 5 
| rex field=provenance "Dashboard:(?<dashboard>.*)" 
| stats max(Count) by dashboard
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...