Hi @python  The following SPL search can used to determine the dashboards which have NOT been used in the last 60 days. There are multiple ways to achieve this however I've gone with the approach of using the _audit index which records the dashboard ID as "provenance" and matches it to the results of the ui/views rest endpoint to ensure we have a list of all dashboards.   index=_audit info=completed action=search provenance!="N/A" provenance!="UI:Search" provenance!="scheduler" earliest=-60d latest=now | stats count by provenance app | eval provenance=replace(replace(provenance,"UI:dashboard:",""),"UI:Dashboard:","") | append [| rest splunk_server=local /servicesNS/-/-/data/ui/views | rename title AS provenance, eai:acl.app AS app] | stats sum(count) as search_count by provenance app | fillnull search_count value=0 | where search_count=0 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

To find alerts that have not triggered, try this query | rest /servicesNS/-/-/saved/searches splunk_server=local | fields title disabled triggered_alert_count alert.severity alert.track eai:acl.app | rename alert.track as isAlert, eai:acl.app as App | eval TriggerCount=coalesce(triggered_alert_count, 0) | where disabled=0 AND TriggerCount=0 AND isAlert=1 | table title alert.severity App ... View more

Other already answered to you, but there is one app https://splunkbase.splunk.com/app/7300 which could help you to find something else which you want get rid of. ... View more

Hi @python  I see you have already accepted an answer to this, however I feel the answer isnt quite right, by using disabled=0 you are missing a bunch of searches which would otherwise be scheduled but have been disabled, so I feel you need to look for is_scheduled = 0 OR (disabled=1 AND is_scheduled = 1) as these are searches which would be scheduled if they werent disabled. | rest /services/saved/searches | search is_scheduled=0 OR (is_scheduled=1 AND disabled=1) alert_type=* | table disabled, is_scheduled, eai:acl.owner, eai:acl.app, title, qualifiedSearch, alert_type 🌟 Did this answer help you? If so, please consider: Adding kudos to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more