Dashboard and App views by user

This Splunk query / search shows historical access to dashboards and apps on a local splunk server.

Share This:


  1. lnogues

    should join on title & app, there is no “app” field in the first part of the query :)

    index=_internal sourcetype=splunk_web_access host=* user=*
    | rex field=uri_path “.*/(?[^/]*)$”
    | join title
    [| rest /servicesNS/-/-/data/ui/views splunk_server=*
    | search isDashboard=1 isVisible=1
    | rename eai:acl.app as app
    | fields title app ]
    | rename title as dashboard
    | stats count by _time user dashboard app host

  2. SplunkPanther

    This is GREAT!

    Is there a way to map the user to their email or name? Would that require another join of some sort?

    I looked into the base search and didn’t see an email or name field.

Leave A Comment?