Hi @grivera_kudaw,
you can delete dashboards from UI interface as an administrator.
My hint is to search in _internal how long they aren't used:
index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app"
| rex field=uri "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)"
| search dashboard!="search" dashboard!="home" dashboard!="alert" dashboard!="lookup_edit" dashboard!="@go" dashboard!="data_lab" dashboard!="dataset" dashboard!="datasets" dashboard!="alerts" dashboard!="dashboards" dashboard!="reports" dashboard!="report"
or
index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app"
| rex field=uri "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)"
| search dashboard="my_unused_dashboard"
so you can be sure that the dashboard is unused in the last period.
To be more sure you could also change access rights on the deleting dashboards (recording old rights) and wait for a period that none shous!
Then you can delete them from UI interface as an administrator, eventually copying sources in a test off-line file.
Ciao.
Giuseppe
... View more