Identify which dashboards are using inline searches

[gagandeep_arora]

I am looking out for a search query to fire on my search head:

My intention is to find all the dashboards / reports that are using inline searches.

[woodcock · Accepted solution]

Like this:

|rest/servicesNS/-/-/data/ui/views | regex eai:data!="<search ref=\"" | table disabled title eai:acl.app eai:appName id

[gcusello]

Hi gagandeep_arora,
use Splunk Distributed Monitoring Console App to monitor your search activity.
In addition you could use Search Activity App (https://splunkbase.splunk.com/app/2632/) but it isn't so easy to configure.

Bye.
Giuseppe

[gcusello]

Hi gagandeep_arora,
use Splunk Distributed Monitoring Console App to monitor your search activity.
In addition you could use Search Activity App (https://splunkbase.splunk.com/app/2632/) but it isn't so easy to configure.

Bye.
Giuseppe

[gagandeep_arora]

Hello cusello,

Thanks for your response. We have had an issue with Search_Activity app. The search head clusters were frequently crashing and we were not knowing from an year. Later Splunk support asked us to disable that app - As the app is no more recommended and was creating crashes for the system.

[gcusello]

Hi gagandeep_arora,
Ok but you could take some searches from this app and use them for your monitoring, without install the full app.
In addition use DMC.
Bye.
Giuseppe