topic Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior? in Getting Data In

In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

gcusello — Tue, 09 Feb 2016 14:37:48 GMT

Hi at all,

I noted that in all my forms with Post Process Search, the Export in CSV button is disabled, even if I force it with link.exportResults.visible=true option.

Anyone know if this is expected behavior or I have to modify something?

Thank you.

Bye.

Giuseppe

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

jeffland — Tue, 09 Feb 2016 15:03:24 GMT

I don't think this is possible (i.e. you're seeing correct behavior). I believe I had read that somewhere, I just can't seem to find the source at the moment. Also see this older question, the topic discussed there is about Advanced XML, but I think it still applies.

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

somesoni2 — Tue, 09 Feb 2016 15:58:01 GMT

The export option is not available when you use Post Process feature. You can see this message confirming the same if you mouse hover on the disabled export button in your dashboard. (Taken from Splunk 6.x Dashboard example app -> Post Process example

alt text

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

jeffland — Wed, 10 Feb 2016 08:57:00 GMT

Ah, right - that's where I read it 🙂

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

gcusello — Wed, 10 Feb 2016 09:01:41 GMT

Ok, I hope that someone in Splunk read these answers!
Is there a workaround? (other than "Open in search")
Thank you.
Giuseppe

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

vbumgarner — Wed, 03 Aug 2016 19:38:23 GMT

Grr. This is annoying.

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

zeinstein — Tue, 25 Apr 2017 13:08:13 GMT

Any hope to get this feature available for post-process searches as well? It would be really useful.

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

vbumgarner — Tue, 25 Apr 2017 15:30:31 GMT

Ahem. Splunk? Squeak. Bump. raises hand shakes fist

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

abilal2 — Thu, 22 Feb 2018 16:25:00 GMT

Would love to have this feature as well.

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

vbumgarner — Wed, 04 Apr 2018 21:02:11 GMT

This is still an issue today.

Could this function, even if it has to run the search again? Perhaps a dashboard option to enable it, which is off by default? Please?

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

Kawtar — Tue, 03 Jul 2018 07:59:03 GMT

This is annoying

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

Kawtar — Tue, 03 Jul 2018 08:00:24 GMT

Hello
Me too .

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

FXT — Wed, 15 Aug 2018 01:57:01 GMT

We are also finding this incredibly frustrating

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

mikeydee77 — Tue, 27 Nov 2018 16:46:00 GMT

Old thread I know... but I would like to add my support for this feature.

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

fsolercasanova — Mon, 07 Jan 2019 19:50:05 GMT

As of 01/2019, In Splunk 7.1.2,

Using Bases for Dashboard panel searches still breaks the export functionality.

This has been a known issue for at least three years.

Are there any plans to fix this feature @splunk ?

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

aldonnelley — Fri, 10 May 2019 03:23:26 GMT

One workaround is to use loadjob:
Put this in your base search -

$job.sid$

Then use -
| loadjob $baseid$ |

Not sure of the implications for search performance, but it ungrays your download button.

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

sylbaea — Fri, 10 May 2019 07:28:22 GMT

@aldonnelley thanks for your suggestion, I am already using something similar but with named scheduled search which is kind of stupid work-around (because of performance impact) but your idea seems slightly better.

I understand you are dynamically reloading the job resulting from the base search SID but I am not clear (from your explanation) how you do save base search SID into baseid token. Could you please clarify ?
Thanks.

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

aldonnelley — Sun, 12 May 2019 22:06:55 GMT

Looks like the code block got stripped.
Set up the base search on your dashboard like this:

<search>
    <query>
        | myquerygoeshere
    </query>
     <done>
        <set token="sid">$job.sid$</set>
    </done>
</search>

then use loadjob to load the base search and extend it as you wish.

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

sylbaea — Mon, 13 May 2019 05:23:56 GMT

makes full sense. thanks a lot

Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

sylbaea — Tue, 14 May 2019 09:06:24 GMT

@aldonnelley, I was very happy about your idea then I found an unexpected side effect...
In my case, "myquerygoeshere" does include misc. input tokens to dynamically filter dashboard content...

with your proposal, I just realised that the "done" event handler is only executed once. If I do change input contents, the base search is re-evaluated as expected... But "sid" token will stick to its original value.
Any idea how to work-around that ?

Note: I put the filtering logic here because it is common to many panels in my dashboard. So moving and duplicating filtering logic into each panel depending on this base search would not be good.