Our Splunk install is fast closing in on 4 years old. Predating me for a good 2-3 years of use. Its got near 400 dashboards and I have no idea which ones are used and which ones are not.
Any idea on how I can get a "number of time this view was loaded in X days" and"last time loaded" meta data about a view/savedsearch etc?
This should get you started:
index=_internal sourcetype=splunkd_ui_access uri="/en-US/app/*/*" | stats latest(_time) as _time count dc(user) by uri_path
One caveat: By default, _internal
is kept around for only 30 days. If that's the case for your environment then no data for some view means "not used in 30 days or more".