How to get dashboard not accessed by anyone in splunk

[harishsplunk7]

I am want to get the list of dashboard which is not used by anyone for more than 90 days. i have tired to use the below query but didnt work well. 

| rest splunk_server=local "/servicesNS/-/-/data/ui/views"
| rename title as dashboard
| fields dashboard

| eval accessed=0
| search NOT
[ search index=_internal sourcetype=splunkd_ui_access earliest=-90d@d
| rex field=uri "/app/[^/]+/(?<dashboard>[^?/\s]+)"
| search NOT dashboard IN ("search", "home", "alert", "lookup_edit", "@go", "data_lab", "dataset", "datasets", "alerts", "dashboards", "reports")
| stats count as accessed by dashboard
| fields dashboard, accessed
]
| stats sum(accessed) as total_accessed by dashboard
| where total_accessed=0
| table dashboard

[harishsplunk7]

Thank you for your response, but your query is providing list of dashboard accessed and i am looking for number of unused/not accessed by anyone. 

[livehybrid · Accepted solution]

Ahhh sorry @harishsplunk7 - I misread!

I've rearranged the query a bit now, how does this look?

| rest splunk_server=local "/servicesNS/-/-/data/ui/views" 
| rename title as dashboard, eai:acl.app as app 
| fields dashboard app 
| eval isDashboard=1 
| append 
    [ search index=_internal sourcetype=splunkd_ui_access earliest=-90d@d uri="*/data/ui/views/*" 
    | rex field=uri "/servicesNS/(?<user>[^/]+)/(?<app>[^/]+)/data/ui/views/(?<dashboard>[^\.?/\s]+)" 
    | search NOT dashboard IN ("search", "home", "alert", "lookup_edit", "@go", "data_lab", "dataset", "datasets", "alerts", "dashboards", "reports") 
    | stats count as accessed by app, dashboard ] 
| stats sum(accessed) as accessed, values(isDashboard) as isDashboard by app, dashboard
| fillnull accessed value=0
| search isDashboard=1 accessed=0

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[livehybrid]

Hi @harishsplunk7 

I dont think your search covers Dashboard Studio dashboards, only Simple XML dashboards (but could be wrong)
Have a go with the following search and let me know how you get on!

index=_internal sourcetype=splunkd_ui_access earliest=-90d@d uri="*/data/ui/views/*"
| rex field=uri "/servicesNS/(?<user>[^/]+)/(?<app>[^/]+)/data/ui/views/(?<dashboard>[^\.?/\s]+)" 
| search NOT dashboard IN ("search", "home", "alert", "lookup_edit", "@go", "data_lab", "dataset", "datasets", "alerts", "dashboards", "reports") 
| stats count as accessed by app, dashboard 
| append 
    [| rest splunk_server=local "/servicesNS/-/-/data/ui/views" 
    | rename title as dashboard, eai:acl.app as app
    | fields dashboard app
    | eval isDashboard=1]
    | stats sum(accessed) as accessed, values(isDashboard) as isDashboard by app, dashboard
    | search isDashboard=1 accessed>0