How to create a table that shows users connected to a specific dashboard and the number of times they viewed it?

[DavidHourani]

Hello Splunkers,

I would like to create a table that shows the users that connected to a specific dashboard and the number of times they viewed it. This is sort of an audit to make sure that the dashboard has been used and to view the users that used it the most.

Is that possible? If so, can anyone help me out and tell me how that can be achieved?

Regards,
David

[David · Accepted solution]

I built a free app for understanding Splunk usage and adoption called Search Activity which should help you do exactly what you're looking for. On the main page in the app you can view the most popular views on the most popular apps in your environment. For any user, you can view what -their- most popular views and apps are, and you can also walk back through time to see what they've done (e.g., David logged in. David browsed to MyCustomView on MyCustomApp. David launched five dashboard searches. etc.). Frankly this is an area for development in my app because of the value potential, so if you find that there's something you can't do out of the box, let me know so I can build it for you!

If you want to go it alone, check out index=_internal sourcetype=splunk_web_access. I filter for GETs where the URL is /[^/]*/app to be able understand view access.

[alacercogitatus]

You can! it is in the _audit index. An even faster way would be to install SoS on a Search head (Splunk on Splunk). This App has a dashboard just for this reason!

[DavidHourani]

Thanks mate! The thing is that with sos you can see the searches that have been run but not the dashboards that have been used and so there is no stats about dashboards usage... I would like to know if someone connected to a specific page. I will check the audit log to see if there is any info about that..