Getting Data In

In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

gcusello
SplunkTrust
SplunkTrust

Hi at all,

I noted that in all my forms with Post Process Search, the Export in CSV button is disabled, even if I force it with link.exportResults.visible=true option.

Anyone know if this is expected behavior or I have to modify something?

Thank you.

Bye.

Giuseppe

1 Solution

somesoni2
SplunkTrust
SplunkTrust

The export option is not available when you use Post Process feature. You can see this message confirming the same if you mouse hover on the disabled export button in your dashboard. (Taken from Splunk 6.x Dashboard example app -> Post Process example

alt text
alt text

View solution in original post

chrabi
Loves-to-Learn Lots

Maybe for someone will be useful:[ How export to csv only 2 rows from base query]

#Workaround Export with Base Search, Post Processing.
1. IN Your dashboard xml
<search id="BASE_SEARCH_EXAMPLE">
<query>
index=_internal  sourcetype=* | fields *
</query>

2. Post Procesing query stats base on base search, show only 2 rows.
<Base Search> | stats count by source | head 2

<table>
<title>Post Processing table with 2 rows for export</title>
<search base="BASE_SEARCH_EXAMPLE">
<done>
<set token="start_query_inputlookup">| inputlookup FileForExport.csv</set>
</done>
<query>| stats count by source
| head 2
| outputlookup FileForExport.csv</query>
</search>
<option name="drilldown">none</option>
</table>

3. Hide table with query "| inputlookup FileForExport.csv" and job.sid required for export token $job_exportTocsv$.

<panel depends="$nevershow$">
<table>
<title>Hide table with import query, job.sid required for export.</title>
<search>
<done>
<set token="job_exportTocsv">$job.sid$</set>
</done>
<query>$start_query_inputlookup$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<refreshType>delay</refreshType>
</search>
</table>
</panel>

4. Button or link required for download csv file, paste someware in dashboard.
<table>
</table>
<html>

<a target="_blank" class="btn" href="/api/search/jobs/$job_exportTocsv$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=FileForExportDetails.csv&amp;outputMode=csv" role="button">Export_Data_csv</a>

</html>
</panel>

0 Karma

aldonnelley
Explorer

One workaround is to use loadjob:
Put this in your base search -

$job.sid$

Then use -
| loadjob $baseid$ |

Not sure of the implications for search performance, but it ungrays your download button.

sylbaea
Communicator

@aldonnelley thanks for your suggestion, I am already using something similar but with named scheduled search which is kind of stupid work-around (because of performance impact) but your idea seems slightly better.

I understand you are dynamically reloading the job resulting from the base search SID but I am not clear (from your explanation) how you do save base search SID into baseid token. Could you please clarify ?
Thanks.

0 Karma

aldonnelley
Explorer

Looks like the code block got stripped.
Set up the base search on your dashboard like this:

<search>
    <query>
        | myquerygoeshere
    </query>
     <done>
        <set token="sid">$job.sid$</set>
    </done>
</search>

then use loadjob to load the base search and extend it as you wish.

0 Karma

sylbaea
Communicator

@aldonnelley, I was very happy about your idea then I found an unexpected side effect...
In my case, "myquerygoeshere" does include misc. input tokens to dynamically filter dashboard content...

with your proposal, I just realised that the "done" event handler is only executed once. If I do change input contents, the base search is re-evaluated as expected... But "sid" token will stick to its original value.
Any idea how to work-around that ?

Note: I put the filtering logic here because it is common to many panels in my dashboard. So moving and duplicating filtering logic into each panel depending on this base search would not be good.

0 Karma

sylbaea
Communicator

makes full sense. thanks a lot

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The export option is not available when you use Post Process feature. You can see this message confirming the same if you mouse hover on the disabled export button in your dashboard. (Taken from Splunk 6.x Dashboard example app -> Post Process example

alt text
alt text

fsolercasanova
Explorer

As of 01/2019, In Splunk 7.1.2,

Using Bases for Dashboard panel searches still breaks the export functionality.

This has been a known issue for at least three years.

Are there any plans to fix this feature @splunk ?

zeinstein
Path Finder

Any hope to get this feature available for post-process searches as well? It would be really useful.

mikeydee77
Path Finder

Old thread I know... but I would like to add my support for this feature.

0 Karma

vbumgarner
Contributor

Ahem. Splunk? Squeak. Bump. raises hand shakes fist

abilal2
Engager

Would love to have this feature as well.

0 Karma

Kawtar
Path Finder

Hello
Me too .

0 Karma

FXT
Engager

We are also finding this incredibly frustrating

0 Karma

vbumgarner
Contributor

Grr. This is annoying.

0 Karma

vbumgarner
Contributor

This is still an issue today.

Could this function, even if it has to run the search again? Perhaps a dashboard option to enable it, which is off by default? Please?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Ok, I hope that someone in Splunk read these answers!
Is there a workaround? (other than "Open in search")
Thank you.
Giuseppe

0 Karma

Kawtar
Path Finder

This is annoying

0 Karma

jeffland
SplunkTrust
SplunkTrust

Ah, right - that's where I read it 🙂

0 Karma

jeffland
SplunkTrust
SplunkTrust

I don't think this is possible (i.e. you're seeing correct behavior). I believe I had read that somewhere, I just can't seem to find the source at the moment. Also see this older question, the topic discussed there is about Advanced XML, but I think it still applies.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...