Getting Data In

Why are report table columns not rendered properly when exporting to PDF or CSV?

clifforg
Explorer

Hello,

I have a report in table format that I have created and saved. This has the columns that I find useful with useful names. When I press export and select PDF, I just get the time and the raw data. When I select CSV I get all columns available rather than just those shown in my saved report.

Can someone assist?

Thank you

M

Tags (4)
0 Karma
1 Solution

grundsch
Communicator

I think you need to select explicitely which column you want to keep, and display them in a table.
Add at the end of your search:

| table Time, User, StartTime, EndTime, Duration, Region, City, Country, rDNS, Gateway

View solution in original post

grundsch
Communicator

I think you need to select explicitely which column you want to keep, and display them in a table.
Add at the end of your search:

| table Time, User, StartTime, EndTime, Duration, Region, City, Country, rDNS, Gateway

clifforg
Explorer

This was exactly the solution - thank you!

somesoni2
SplunkTrust
SplunkTrust

What is your report query? Are you using any 'table' or aggregation commands such as stats,chart etc?

0 Karma

clifforg
Explorer

Here is my search

index=citrix_ns AND "SSLVPN ICAEND_CONNSTAT" | lookup dnslookup clientip AS CitrixNS_SourceIP OUTPUT clienthost AS rDNS | iplocation CitrixNS_SourceIP AS src_ip | rename CitrixNS_user As User CitrixNS_SourceIP As SourceIP CitrixNS_StartTime As StartTime CitrixNS_EndTime As EndTime CitrixNS_Duration As Duration host As Gateway | eval Time=_time | convert ctime(Time)

It won't let me attach a screenshot of the report but i have the columns sorted

_time
User
StartTime
EndTime
Duration
Region
City
Country
rDNS
Gateway

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...