I am looking out for a search query to fire on my search head:
My intention is to find all the dashboards / reports that are using inline searches.
Like this:
|rest/servicesNS/-/-/data/ui/views | regex eai:data!="<search ref=\"" | table disabled title eai:acl.app eai:appName id
Like this:
|rest/servicesNS/-/-/data/ui/views | regex eai:data!="<search ref=\"" | table disabled title eai:acl.app eai:appName id
Hi gagandeep_arora,
use Splunk Distributed Monitoring Console App to monitor your search activity.
In addition you could use Search Activity App (https://splunkbase.splunk.com/app/2632/) but it isn't so easy to configure.
Bye.
Giuseppe
Hi gagandeep_arora,
use Splunk Distributed Monitoring Console App to monitor your search activity.
In addition you could use Search Activity App (https://splunkbase.splunk.com/app/2632/) but it isn't so easy to configure.
Bye.
Giuseppe
Hello cusello,
Thanks for your response. We have had an issue with Search_Activity app. The search head clusters were frequently crashing and we were not knowing from an year. Later Splunk support asked us to disable that app - As the app is no more recommended and was creating crashes for the system.
Hi gagandeep_arora,
Ok but you could take some searches from this app and use them for your monitoring, without install the full app.
In addition use DMC.
Bye.
Giuseppe