Splunk Search

How to generate a search that will look for Splunk apps that have not been used?

cdo_splunk
Splunk Employee
Splunk Employee

Any one know of a search that will look for Splunk apps that have not been used by any user for a week, etc?

Tags (3)
1 Solution

gokadroid
Motivator

Since every app when invoked first can only be accessed by invoking the app url hence how about searching the index=_internal and sourcetype=splunk_web_access to find all the invocations of the app url and rex(ing) the data out for yourself something like this:

outer search to find all app urls invoked till today NOT ( [ subsearch to find the url apps which were accessed within last 7 days ] )

So your query should look something like:

index=_internal  sourcetype=splunk_web_access ((http\:\/\/) OR (https\:\/\/)) (\/app\/) NOT ([ search index=_internal sourcetype=splunk_web_access ((http\:\/\/) OR (https\:\/\/)) (\/app\/) earliest=-7d@d | rex ".*\"(?<url>http(s)*\:\/\/.*\/app\/[^\/]+)"| table url | dedup url| return 10000 $url])
| rex ".*\"(?<url>http(s)*\:\/\/[^\"]+)\"" 
| rex field=url "http(s)*\:\/\/(?<domain>[^\:]+)\:(?<port>[^\/]+)\/.*\/app\/(?<appName>[^\/]+).*" 
| table appName 
| dedup appName

View solution in original post

gokadroid
Motivator

Since every app when invoked first can only be accessed by invoking the app url hence how about searching the index=_internal and sourcetype=splunk_web_access to find all the invocations of the app url and rex(ing) the data out for yourself something like this:

outer search to find all app urls invoked till today NOT ( [ subsearch to find the url apps which were accessed within last 7 days ] )

So your query should look something like:

index=_internal  sourcetype=splunk_web_access ((http\:\/\/) OR (https\:\/\/)) (\/app\/) NOT ([ search index=_internal sourcetype=splunk_web_access ((http\:\/\/) OR (https\:\/\/)) (\/app\/) earliest=-7d@d | rex ".*\"(?<url>http(s)*\:\/\/.*\/app\/[^\/]+)"| table url | dedup url| return 10000 $url])
| rex ".*\"(?<url>http(s)*\:\/\/[^\"]+)\"" 
| rex field=url "http(s)*\:\/\/(?<domain>[^\:]+)\:(?<port>[^\/]+)\/.*\/app\/(?<appName>[^\/]+).*" 
| table appName 
| dedup appName

martin_mueller
SplunkTrust
SplunkTrust

Answering this is inherently hard because of the different aspects contained in an app.

Dashboards and saved searches are fairly easy to check because users have to access them explicitly - they'll be in _internal. Knowledge objects are much harder to check - especially if your app shares them globally.
Take lookups as an example. You could crawl all searches for an explicit | lookup lookup_name, but you'd also have to check if automatic lookups were implicitly triggered somewhere. Without instrumentation from Splunk Core, that's an unanswerable question at the moment 😞

cmerriman
Super Champion

take a look at this answers:
https://answers.splunk.com/answers/316312/ever-wonder-which-dashboards-are-being-used-and-wh.html

it shows which users use the dashboards and which dashboards are being used. i'm sure you can tweak it to look at which dashboards aren't being used.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...