All Apps and Add-ons

Can we group all the panels in a dashboard as one and download all of them at once in sideview editor?

shrey12
Explorer
0 Karma

sideview
SplunkTrust
SplunkTrust

OK. restating your question a bit here - "on my dashboard there are lots of panels each with a SearchControls module. Is there a way the user can effectively download csv output for all of the results for all of them at once?"

The answer I'm afraid is not really. You could technically do some strange things with the append and loadjob command, to basically glom all the rows of the 25 searches together into one super-result. However the columns are presumably different from report to report and even if they weren't I think the resulting mismash.csv would be pretty confusing.

However... there may be another solution. the fact that you're asking this question at all suggests that the 25 searches are at least thematically similar, and that the search language may be pretty similar. It may be feasible to refactor the dashboard so as to use the PostProcess mechanism. In this way there could be only one base search involved, and thus one set of "base search results", and 25 different postprocess searches could carve different slices out of this high-dimensional dataset, so as to render each of the 25 panels. 25 is a big number for this... However it's quite possible to break it up into 2 or 3 base searches. What I'm thinking is that you could get down to 2 or 3 SearchControls modules instead of 25...

Either way getting there will involve sharing your dashboard XML as well as the full search language. It may be more of a slogfest than is palatable for you to be honest. Postprocess refactoring is a pretty advanced topic in Splunk (Read in Sideview Utils "Key Techniques > PostProcess > An Introduction to PostProcess")

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm afraid I do not understand this question. When you edit a dashboard in the Sideview Editor you have the ability to edit any of the panels therein.

Do you perhaps mean that there is some repeated block of XML and you wish to avoid editing the multiple copies? If so please post the XML somewhere like pastebin - it's possible that the repetition itself can be eliminated.

0 Karma

shrey12
Explorer

I have 25 panels in a dashboard. I want to be able to download all of them at once instead of downloading one panel at a time

0 Karma

sideview
SplunkTrust
SplunkTrust

Just not sure what you mean by download. Do you mean that navigating around in the schematic view is tedious and time consuming? As sub-branches of the config appear and dissappear in the schematic view they're not technically downloading anything but I can see why it might look that way.

Can you post your XML? It's possible that it's unnecessarily nested and by removing/simplifying/refactoring it, it could become a bit less verbose.

0 Karma

shrey12
Explorer

by download I mean saving the dashboard it in any specific format !

0 Karma

sideview
SplunkTrust
SplunkTrust

Do you mean that each panel has a download button or a SearchControls module? And that you wish to give the user the ability to effectively download all of the results for all 25 searches at once? If so, sorry I thought this was a question about the Sideview Editor specifically.

0 Karma

shrey12
Explorer

yes thats exactly what i wanted to do . sorry for the confusion

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...