Splunk search for Find old, unused dashboards

Copy


			| rest /servicesNS/-/-/data/ui/views splunk_server=* 
| search isDashboard=1 
| rename eai:acl.app as app 
| fields title app 
| join type=left title 
[| search index=_internal sourcetype=splunk_web_access host=* user=* 
| rex field=uri_path ".*/(?<title>[^/]*)$" 
| stats latest(_time) as Time latest(user) as user by title
] 
| eval Now=now() 
| eval "Days Since Last Viewed"=if(isnull(Time),"Never accessed",round((Now-Time)/86400))
| sort Time
| convert ctime(Time) 
| fields - Now

This search will provide insight on how recently dashboards have been accessed. This is useful if you are attempting to perform an audit to identify old dashboards that are no longer in use.

0 comments

[0]

Category:

General Splunk

Tags:

rest administration dashboards

Search Commands: