Reporting

When you export a report to PDF all you get is the data. Is possible to also include the search criteria that produced that data in Splunk 6.1.1?

johnw10
Engager

When you export a report to PDF all you get is the data. Is possible to also include the search criteria that produced that data in Splunk 6.1.1?

Tags (4)
0 Karma

acharlieh
Influencer

By "Search Criteria" and given the comment, I'm guessing you mean the timerange of a search, which you could add to another panel(s) (single value perhaps?) using an additional search. Now since since you cannot have a shared time picker and generate a PDF dashboard, there is some additional work on you the dashboard creator to ensure that the time range of this new search, matches the time ranges of the other searches of the dashboard:

| noop | stats count 
| addinfo
| convert timeformat="%FT%T" ctime(*_time)
| eval value = info_min_time. " -> ". info_max_time
| fields value

How this search works line by line is as follows:

  • | noop | stats count is a trick to create a search with a single result, using the undocumented "do nothing" noop command followed by using stats to count that nothing. (There are other documented ways to accomplish a similar result but noop is a personal favorite )
  • addinfo tacks on additional fields to each result (our single result in this case) that tell among other things the earliest and latest timestamps selected for the current search
  • convert we use to change the seconds-since-epoch timestamps to a human readable format. (Exactly what timeformat is desired is up to you of course)
  • eval to build the string we want to display in the panel
  • and finally fields to eliminate all other fields. (alternatively you could use the options of the single value panel to pick which field you want to display)
0 Karma

SamMcC
New Member

This is a brilliant question and I have been trying to find the answer for this for some time now.

What is the first thing people look at when you hand them the report, the period that the report is generated for???

Unfortunately, it appears that Splunk cannot perform this very very very basic requirement, poor poor poor.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...