Should be able to check index=_audit for search run times for each individual search running on dashboards. Something like this. index="_audit" action=search provenance="UI:Dashboard:*"
|...
See more...
Should be able to check index=_audit for search run times for each individual search running on dashboards. Something like this. index="_audit" action=search provenance="UI:Dashboard:*"
| table _time, user, app, provenance, savedsearch_name, search_id, total_run_time, event_count, result_count, search_et, search_lt
| eval
dashboard_id=mvindex(split(provenance, ":"), 2, -1)