Dashboards & Visualizations

Can you find a way to see if a report is attached to a dashboard?

HealyManTech
Explorer

Is there a way to see if a report is attached to a dashboard?

I am clean up report and don't remember which ones I had attached to my daily dashboards. Does anyone know? Or if you go to delete a report will it tell you something like this "This report is part of Dashboard Name?

Thanks for the help.

0 Karma
1 Solution

niketn
Legend

@HealyManTech you can run the following REST command to pull all views (dashboards/forms) which refer to your report Your Report Name

|  rest /servicesNS/-/-/data/ui/views/
|  search "eai:data"="*Your Report Name*"

PS:
1) The hyphens after servicesNS represent all user and all apps. You can provide specific user name or app name if required. Another option would be to pull all users and all apps and filter afterwards with "eai:appName" and eai:acl.owner respectively.

2) Wildcards asterisk * are required before and after "*Your Report Name*" to match across Dashboard Code. Reports can be included in Dashboard using <ref="Your Report Name"> or it can also be run using | savedsearch "Your Report Name" command.

Do backup the code for your Report from savedsearches.conf and local.meta file.
Please try out and confirm!

Refer to Splunk Documentation for REST API :http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Fui.2Fviews

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@HealyManTech you can run the following REST command to pull all views (dashboards/forms) which refer to your report Your Report Name

|  rest /servicesNS/-/-/data/ui/views/
|  search "eai:data"="*Your Report Name*"

PS:
1) The hyphens after servicesNS represent all user and all apps. You can provide specific user name or app name if required. Another option would be to pull all users and all apps and filter afterwards with "eai:appName" and eai:acl.owner respectively.

2) Wildcards asterisk * are required before and after "*Your Report Name*" to match across Dashboard Code. Reports can be included in Dashboard using <ref="Your Report Name"> or it can also be run using | savedsearch "Your Report Name" command.

Do backup the code for your Report from savedsearches.conf and local.meta file.
Please try out and confirm!

Refer to Splunk Documentation for REST API :http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Fui.2Fviews

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

HealyManTech
Explorer

If it comes back with zero results would that mean it wasn't saved anywhere?

0 Karma

niketn
Legend

If you are sure of a dashboard that uses this or any other Saved Search, you can try adjusting the query to test. Also, can you provide the current search you are running (mask/anonymize any sensitive information)?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...