I want to create a Splunk dashboard that breaks down a splunk dashboard: What app does it belong too. what index or indexes feed it. what sourcetype or sourcetypes feed it. Users accessing it Any other detail you might find useful, this can be a very powerful tool for anyone, and I see to find bits and pieces of this around the community so it must mean someone either already did it, or is planning to. Something kinda this     <form version="1.6" theme="dark"> <label>Custom Dashboard Usage</label> <!-- 1.1 Added line view and host info 1.2 Added sort 1.3 Added sort by in dashboard 1.4 Fixed new forma 1.5 Fixed dashboard regex by adding space and added Pie chart 1.6 Fixed missing user --> <search id="base_search"> <query> index="_internal" "data/ui/views/" NOT "servicesNS/-" sourcetype=splunkd_ui_access | rex "(?&lt;app&gt;[^\/]+)\/data\/ui\/views\/(?&lt;dashboard&gt;[^? ]+)" | rex "servicesNS\/(?&lt;user2&gt;[^\/]+)" | rex mode=sed field=user2 "s/%40/@/" | eval user=if(user="-",user2,user) | search app=* host="$Host$" user="$User$" app="$App$" dashboard="$Dashboard$" | fields _time host user app dashboard </query> </search> <fieldset submitButton="false"> <input type="time"> <label>Max is 30 days back</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="Host"> <label>Host</label> <search base="base_search"> <query> | eval data=host | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="User"> <label>User</label> <search base="base_search"> <query> | eval data=user | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="App"> <label>Application</label> <search base="base_search"> <query> | eval data=app | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Dashboard"> <label>Dashboard</label> <search base="base_search"> <query> | eval data=dashboard | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Sort"> <label>Graph by</label> <choice value="dashboard">Dashboard</choice> <choice value="app">Application</choice> <choice value="user">User</choice> <choice value="host">Host</choice> <default>dashboard</default> </input> </fieldset> <row> <panel> <chart> <title>Dashboards usage frequency by count</title> <search base="base_search"> <query> | timechart limit=25 useother=f count by $Sort$ </query> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.fieldColors">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</option> <option name="height">400</option> </chart> </panel> <panel> <chart> <title>Dashboards usage frequency by percent</title> <search base="base_search"> <query> | stats count by $Sort$ </query> </search> <option name="charting.chart">pie</option> <option name="charting.fieldColors">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</option> <option name="height">385</option> </chart> </panel> </row> <row> <panel> <table> <title>Dashboards usage frequency by time, sh-server, user &amp; application</title> <search base="base_search"> <query> | sort 0 - _time | table _time host user app dashboard </query> </search> <option name="count">50</option> <format type="color" field="host"> <colorPalette type="map">{"m-cluster-01":#55C169,"m-cluster-02":#55C169,"m-cluster-03":#55C169,"m-cluster-04":#55C169,"m-test":#D41F1F,"m-master-deploy":#FFFF00,"m-monitor":#1182F3,"m-search-tphp":#E3723A,"m-search-helsemn":#D94E17,"m-deploy":#88527D,"m-collector-01":#65778A,"p-collector-01":#65778A,"h-collector-01":#65778A}</colorPalette> </format> <format type="color" field="user"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="app"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="dashboard"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> </row> </form>     ... View more

Here is the index stanza:   [new_dex] homePath = volume:hotwarm/new_dex/db coldPath = volume:cold/new_dex/colddb thawedPath = $SPLUNK_DB/new_dex/thaweddb maxTotalDataSizeMB = 2355200 homePath.maxDataSizeMB = 2944000 maxWarmDBCount = 4294967295 // I know this is wrong, but need help setting it frozenTimePeriodInSecs = 15552000 maxDataSize = auto_high_volume repFactor=auto   Also, any other key = pair should be added. There are 18 indexers deployed each with a 16T of size. frozenTimePeriodInSecs has been met, but data is not being moved/deleted.           what configuration/details am I missing here? I needed data gone! ... View more

Currently, each of my indexes is set to a specific and own frozenTimePeriodInSecs, but I am noticing they are not rolling over to cold when the frozenTimePeriodInSecs value is set. Data Age (keeps growing) vs Frozen Age (stays as what it is set in frozenTimePeriodInSecs) maxWarmDBCount is set to:   maxWarmDBCount = 4294967295    Does this effect? If the value is changed, would data roll to cold? ... View more