I know this question is old but I had a similar question and wasn't able to find an answer. This search will find dashboards that haven't been accessed in more than 60 days.
| rest /servicesNS/-/-/data/ui/views splunk_server=*
| search eai:acl.app!="search" AND eai:acl.app!="splunk_management_console" AND eai:acl.app!="splunk_monitoring_console" AND isDashboard=1
| rename eai:acl.app AS app
| fields title app author
| join type=left title
[| search index=_internal sourcetype=splunk_web_access host=* user=*
| rex field=uri_path ".*/(?<title>[^/]*)$"
| stats latest(_time) as Time latest(user) as user by title]
| where isnotnull(Time)
| eval Now=now()
| eval days=round((Now-Time)/86400,2)
| sort - days
| convert ctime(Time)
| table app title days Time user author
| fields - Now
| search days > 60
| rename days AS "Days since last accessed"
Run it over the last 90 days.
If your log retention is set at the default 30 days, look at pgreer's answer above.
... View more
