CODEWITHSUNDEEP
splunksplunk-querysplunk-dashboard
Milo_Dev
Milo_Dev

Reputation: 425

How do I Query on Splunk Dashboard information

We are currently using ADO (pipeline artifacts) to Splunk for Build step reviews. I am working on a project to migrate Splunk Dashboards to powerbi. I need a query to list down the Dashboards and reports from Splunk on the below criteria so we would identify which ones to be created in powerbi

  1. List of Dashboards / reports (possibly with Author details)
  2. frequency of usage - like how many times the Dashboard / reports was viewed in the last 30 days

I tried few queries from mysplunk but it did not give the result. Thanks for any inputs / suggestions. Thanks.

Upvotes: 0

Views: 2462

Answers (2)

Milo_Dev
Milo_Dev

Reputation: 425

The below queries worked for me ..

To list the Dashboards | rest /servicesNS/-/-/data/ui/views | table title,app,owner,eai:data,description,updated,version

To list the reports |rest /servicesNS/-/-/saved/searches |table title,app,owner

Please note this will list down the default dashboards from Splunk that you may want to filter out.

I am still working on the query for the usage frequency . Thanks.

Upvotes: 0

RichG
RichG

Reputation: 9926

It would help to know what you've tried so far.

To get a list of dashboards, try this query:

| rest /servicesNS/-/-/data/ui/views

To see which dashboards have been viewed, search the Splunk UI access log.

index=_internal sourcetype=splunkd_ui_access
| rex "\\/data\\/ui\\/views\\/(?<dashboard>[^\?]+)"
| stats count by dashboard

Upvotes: 0

Related Questions