search to know when a new dashboard or report is created

[a212830]

Hi,

Is there a search that can identify when a new scheduled search, report, or dashboard is created? Is it possible by user?

[martin_mueller · Accepted solution]

While there's no feature for this available out-of-the-box, it's quite simple to build your own. I'll use scheduled searches as an example, other objects work in a similar fashion.

First, you'll want to find out what scheduled searches exist - query the relevant REST endpoint for that. Sadly, that doesn't tell you when an object was created, so you'll have to maintain that state yourself in a lookup (http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/ for some background)... so you create a lookup scheduled_searches or whatever. Then you schedule a search merging the lookup with the REST output to update the lookup, and alert whenever something new is added. It'll consider an old search that just had its scheduling enabled as alert-worthy.

The search then looks like this (broken into lines for structure):

| rest /servicesNS/-/-/saved/searches search="is_scheduled=1" | fields title author eai:acl.app
| eval rest = 1 | inputlookup append=t saved_searches | stats first(author) as author first(first_seen) as first_seen first(rest) as rest by title eai:acl.app | where rest==1 | fields - rest
| eval first_seen = coalesce(first_seen, now()) | outputlookup saved_searches | where first_seen==now()

Note, it's best to run this as admin - then you get the most visibility and catch all the scheduled searches. Schedule the alert as often as you want.

[edwardrose]

How would you convert the first_seen to a date/time stamp that management can read.

I was thinking of using convert ctime(first_seen) right after the stats command like so
| rest /servicesNS/-/-/saved/searches search="is_scheduled=*"
| rename eai:acl.app as app, title as dashboard
| fields dashboard visible author app updated
| eval rest = 1
| inputlookup append=t dashboard_output.csv
| stats first(author) as author first(first_seen) as first_seen first(rest) as rest by dashboard app
| convert ctime(first_seen)
| where rest==1
| fields - rest
| eval first_seen = coalesce(first_seen, now())
| outputlookup dashboard_output.csv
| where first_seen==now()

[martin_mueller]

An additional thought, consider how you want to handle disabled searches. Do you want to be alerted when someone enables an old scheduled search? If so, add disabled=0 to the search attribute of the rest command.

[a212830]

Fantastic. Thanks!