index=_internal sourcetype=splunk_web_access host=* user=*
| rex field=uri_path ".*/(?<title>[^/]*)$"
| join title
[| rest /servicesNS/-/-/data/ui/views splunk_server=*
| search isDashboard=1 isVisible=1
| rename eai:acl.app as app
| fields title app ]
| rename title as dashboard
| stats count by _time user dashboard app host | rename user as User, dashboard as Dashboard, app as App, host as Host, count as Count
0 comments
[0]
[0]
[0]
[0]
| rest /servicesNS/-/-/data/ui/views splunk_server=*
| search isDashboard=1
| rename eai:acl.app as app
| fields title app
| join type=left title
[| search index=_internal sourcetype=splunk_web_access host=* user=*
| rex field=uri_path ".*/(?<title>[^/]*)$"
| stats latest(_time) as Time latest(user) as user by title
]
| eval Now=now()
| eval "Days Since Last Viewed"=if(isnull(Time),"Never accessed",round((Now-Time)/86400))
| sort Time
| convert ctime(Time)
| fields - Now
0 comments
[0]
[0]
[0]
[0]