Splunk Search

Splunk Rest Query to see the definitions of all dashboards ( public & private )

splunkfriend123
Engager

Hi Team,

We had couple of dashboards who created by ex-employees and existing team is unable to access them.

Even we dont have access to admin privileges to access .

Is there any rest query to fetch dashbaord name and along with the query ( code ) so that we can save them as new name and use it for reference. 

 

Thank you,

SriCharan

 

Labels (2)
Tags (2)
0 Karma
1 Solution

marysan
Communicator

you need eai:data field too :

| rest /servicesNS/-/-/data/ui/views

| rename eai:acl.app AS app
| rename eai:acl.perms.write as dashboard-write-permission
| rename eai:acl.perms.read as dashboard-read-permission
| rename eai:appName as appName
| rename eai:data AS data
| join type=outer appName
[| rest /servicesNS/-/-/apps/local
| rename title AS appName
| rename eai:acl.perms.read AS app-read-permission
| rename eai:acl.perms.write AS app-write-permission]
| table app label title dashboard-read-permission dashboard-read-permission app-write-permission app-read-permission data

View solution in original post

Tags (2)
0 Karma

gcusello
Legend

Hi @splunkfriend123,

to have the list of all your dashboards you can use the search shared by @Splunker96.

To change the owner of these dashboard, it depends on the share level of them:

if they are private, you have to move them by CLI from the $SPLUNK_HOME/etc/users/<user_name>/apps/<your_app>/local folder into your username folder, or to copy them and use the code to create a new one.

If they are in an App, you have to modify $SPLUNK_HOME/etc/apps/<your_app>/metadata/meta.local the owner of your dashboards.

In both cases, you have to restart Splunk.

Ciao.

Giuseppe

0 Karma

Splunker96
Builder

@splunkfriend123 try this

| rest /servicesNS/-/-/data/ui/views

| rename eai:acl.app AS app

| rename eai:acl.perms.write as dashboard-write-permission

| rename eai:acl.perms.read as dashboard-read-permission

| rename eai:appName as appName

| join type=outer appName

[| rest /servicesNS/-/-/apps/local

| rename title AS appName

| rename eai:acl.perms.read AS app-read-permission

| rename eai:acl.perms.write AS app-write-permission]

| table app label title dashboard-read-permission dashboard-read-permission app-write-permission app-read-permission

0 Karma

splunkfriend123
Engager

Hi @Splunker96  :

Thanks a ton for your quick response.

The query you provided fetches dashboard name but not its definition.

Is there any way to modify this query to fetch the definition ( query used for  creating dashboard ) ? 

Many thanks in advance. 

0 Karma

marysan
Communicator

you need eai:data field too :

| rest /servicesNS/-/-/data/ui/views

| rename eai:acl.app AS app
| rename eai:acl.perms.write as dashboard-write-permission
| rename eai:acl.perms.read as dashboard-read-permission
| rename eai:appName as appName
| rename eai:data AS data
| join type=outer appName
[| rest /servicesNS/-/-/apps/local
| rename title AS appName
| rename eai:acl.perms.read AS app-read-permission
| rename eai:acl.perms.write AS app-write-permission]
| table app label title dashboard-read-permission dashboard-read-permission app-write-permission app-read-permission data

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...