Search code examples
splunksplunk-querysplunk-dashboard

How do I Query on Splunk Dashboard information

We are currently using ADO (pipeline artifacts) to Splunk for Build step reviews. I am working on a project to migrate Splunk Dashboards to powerbi. I need a query to list down the Dashboards and reports from Splunk on the below criteria so we would identify which ones to be created in powerbi

  1. List of Dashboards / reports (possibly with Author details)
  2. frequency of usage - like how many times the Dashboard / reports was viewed in the last 30 days

I tried few queries from mysplunk but it did not give the result. Thanks for any inputs / suggestions. Thanks.

Solution

  • It would help to know what you've tried so far.

    To get a list of dashboards, try this query:

    | rest /servicesNS/-/-/data/ui/views

    To see which dashboards have been viewed, search the Splunk UI access log.

    index=_internal sourcetype=splunkd_ui_access
| rex "\\/data\\/ui\\/views\\/(?<dashboard>[^\?]+)"
| stats count by dashboard