Dashboards & Visualizations

Is it possible to download the XML of a dashboard? (using Python)

tzoellner
Explorer

Hello!

I try to write a python script that shall download the XML of a dashboard. After that some tokens shall be replaced and then I want to upload the XML.

Is there any method in the splunk SDK for python that can help?

With best regards,
Torben

1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi tzoellner,

You can use SPLUNI REST API for creating/updating dashboards.

  • Get the dashboard XML using API.
  • Replace the token and savedsearches.
  • Create / Update Dashboard XML using API.

Create a python file & call SPLUNK API for creating/updating dashboards.

To create a new dashboard named "newdash":

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/search/data/ui/views/ -d 'name=newdash' -d 'eai:data=<put your xml here>'

To edit an existing dashboard with the name "newdash":

curl -ku admin:changeme https://localhost:8089/servicesNS/nobody/search/data/ui/views/newdash -d 'eai:data=<put your xml here>'

Take a look at the keys that are returned from the endpoint, that should give you a pretty good idea of what you can change.

http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Fui.2Fviews.2F.7Bname...

I hope this approach will be useful to you. Let me know any help need you for API.

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi tzoellner,

You can use SPLUNI REST API for creating/updating dashboards.

  • Get the dashboard XML using API.
  • Replace the token and savedsearches.
  • Create / Update Dashboard XML using API.

Create a python file & call SPLUNK API for creating/updating dashboards.

To create a new dashboard named "newdash":

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/search/data/ui/views/ -d 'name=newdash' -d 'eai:data=<put your xml here>'

To edit an existing dashboard with the name "newdash":

curl -ku admin:changeme https://localhost:8089/servicesNS/nobody/search/data/ui/views/newdash -d 'eai:data=<put your xml here>'

Take a look at the keys that are returned from the endpoint, that should give you a pretty good idea of what you can change.

http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Fui.2Fviews.2F.7Bname...

I hope this approach will be useful to you. Let me know any help need you for API.

Thanks

tzoellner
Explorer

Hi!

One last question: How can I access a dashboard, that I own, but ist not private? The server response always say, that my dashboard would not exist, when it is no longer private.

Thanks!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi tzoellner,

How you are accessing dashboard? using splunk web UI or CURL command ??

Thanks

0 Karma

tzoellner
Explorer

I am accessing it with the following curl command:

curl -k -u USER:PASS https://URL:PORT/servicesNS/USER/APP/data/ui/views/DASHBOARDID -d "eai:data=Test"

(Capslock expressions are variables)

This works as long as the dashboard is private. When I change it so, that the whole app can see the dashboard, then the command does no longer work.

0 Karma

thanikeshn
Loves-to-Learn Lots

i have a similar requirement to download the dashboard xml , i want to know how to get the dashboard ID

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi tzoellner,

Can you please try below command??

curl -k -u USER:PASS https://URL:PORT/servicesNS/nobody/APP/data/ui/views/DASHBOARDID -d "eai:data=Test"

(I have just replaced USER to nobody)

Thanks

0 Karma

tzoellner
Explorer

Thank you!

That works perfectly!

Thanks!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Great.

When you creating a dashboard using particular user then dashboard permission will be private and will be accessible to that user. In this scenario XML file will be created in that particular user context (SPLUNK_HOME/etc/user/USERNAME/APP/local/data/ui/views/). In this case curl -k -u USER:PASS https://URL:PORT/servicesNS/USER/APP/data/ui/views/DASHBOARDID -d "eai:data=Test" command is proper.

When you change permission from private to the app then now dashboard will be accessible by others and the path of XML will be changed to SPLUNK_HOME/etc/apps/APP/local/data/ui/views/. In this case, we cannot use username which is used at the time of creation of dashboard. So here we have used nobody user to access the dashboard.

If this answer helps you then accept to close this question.

Thanks.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi tzoellner,

I want to more about your requirement.

From where you will execute python script?? Means, are you executing a script from the same machine which runs Splunk OR other than Splunk machine??

Thanks.

0 Karma

tzoellner
Explorer

Hi kamlesh_vaghela,

It will run on the server in the end. But I am testing it on an external machine.

Thanks for the help!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi tzoellner,

I don't think Splunk Python SDK provide creation or updating of dashboard xml. If you want to do so you can use file operations of python for reading and writing dashboard xml file.

Can you please let me know the purpose of updating token of dashbard xml from python script ? So I can help out to get you into the right direction.

Thanks

0 Karma

tzoellner
Explorer

Hi kamlesh_vaghela,

The purpose of this script is to update some reports. For this we want to copy the XML of a given dashboard and replace the tokens in it with actual values and update the saved searches. (I dont know if I explained this correctly, this part has been made by a co-worker).

Since now we had to copy the dashboard XML by hand via the "edit"-button.

We want to make this automatic (also we want to make the upload of the report automatic).

I also tried to use urllib2 to get the contents of the website but I always only get some

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...