SPL
Find unused dashboards
Description
Use this search to find unused dashboards:
18 5
| rest /servicesNS/-/-/data/ui/views splunk_server=* | search isDashboard=1 | rename eai:acl.app as app | fields title app | join type=left title [| search index=_internal sourcetype=splunk_web_access host=* user=* | rex field=uri_path ".*/(?<title>[^/]*)$" | stats latest(_time) as Time latest(user) as user by title ] | where isnotnull(Time) | eval Now=now() | eval "Days since last accessed"=round((Now-Time)/86400,2) | sort - "Days since last accessed" | convert ctime(Time) | fields - NowAdmin Notes - Fantastic query! I modified the SPL slightly as I had an issue when I copied it to my two test environments.
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.