Reporting

In 4.3, the Advanced Charting view generates a 0 byte file when you try to Export Unlimited.

jbsplunk
Splunk Employee
Splunk Employee

Under 4.3, you have the ability to export either Unlimited or 10000 results. Looks like in the Advanced Charting view, unlimited does not work at all for any of the 3 formats: CSV, XML or JSON. Has anyone else seen this behavior?

Tags (1)
1 Solution

Ellen
Splunk Employee
Splunk Employee

In 4.3 through 4.3.2 this is a known issue, SPL-51334.

The temporary workaround is to make the simple modification in the charting view's xml as below.

Note: a restart is not necessary and the number of results returned is not a factor

Modify the charting view's xml via:
Manager > User Interface > Views > charting

Replace the text "event" to "result" in the following line and Save:
From:

<module name="Export"><param name="exportType">event</param></module>

To:

<module name="Export"><param name="exportType">result</param></module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

For me it's broken whether or not you pick unlimited or whether you set a limit. The problem seems to arise when the search is anything other than a trivial "events" search. IE if you have any stats commands in there, or any transforming/reporting commands, the export will generate only an empty csv.

0 Karma

Ellen
Splunk Employee
Splunk Employee

In 4.3 through 4.3.2 this is a known issue, SPL-51334.

The temporary workaround is to make the simple modification in the charting view's xml as below.

Note: a restart is not necessary and the number of results returned is not a factor

Modify the charting view's xml via:
Manager > User Interface > Views > charting

Replace the text "event" to "result" in the following line and Save:
From:

<module name="Export"><param name="exportType">event</param></module>

To:

<module name="Export"><param name="exportType">result</param></module>
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...