Splunk Search

Identify which dashboards are using inline searches

gagandeep_arora
Path Finder

I am looking out for a search query to fire on my search head:

My intention is to find all the dashboards / reports that are using inline searches.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|rest/servicesNS/-/-/data/ui/views | regex eai:data!="<search ref=\"" | table disabled title eai:acl.app eai:appName id

View solution in original post

woodcock
Esteemed Legend

Like this:

|rest/servicesNS/-/-/data/ui/views | regex eai:data!="<search ref=\"" | table disabled title eai:acl.app eai:appName id

View solution in original post

gcusello
Legend

Hi gagandeep_arora,
use Splunk Distributed Monitoring Console App to monitor your search activity.
In addition you could use Search Activity App (https://splunkbase.splunk.com/app/2632/) but it isn't so easy to configure.

Bye.
Giuseppe

0 Karma

gcusello
Legend

Hi gagandeep_arora,
use Splunk Distributed Monitoring Console App to monitor your search activity.
In addition you could use Search Activity App (https://splunkbase.splunk.com/app/2632/) but it isn't so easy to configure.

Bye.
Giuseppe

0 Karma

gagandeep_arora
Path Finder

Hello cusello,

Thanks for your response. We have had an issue with Search_Activity app. The search head clusters were frequently crashing and we were not knowing from an year. Later Splunk support asked us to disable that app - As the app is no more recommended and was creating crashes for the system.

0 Karma

gcusello
Legend

Hi gagandeep_arora,
Ok but you could take some searches from this app and use them for your monitoring, without install the full app.
In addition use DMC.
Bye.
Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!