topic Re: Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file? in Dashboards & Visualizations

Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file?

splunkvickyloui — Tue, 29 Sep 2020 08:47:21 GMT

Hi,

We are using Splunk Enterprise 6.2.1. We have two separate search heads. In each search head we have configured many Reports, Alerts, and Dashboards. I want to export those Reports, Alerts, and Dashboards which configured by all the user to single excel (csv) file. Is there any search to have the below fields?

Thanks in advance.

Re: Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file?

somesoni2 — Wed, 10 Feb 2016 23:15:57 GMT

Try something like this

| rest /servicesNS/-/-/saved/searches splunk_server=local | table author title description search dispatch.earliest_time dispatch.latest_time auto_summarize.cron_schedule action.email.to alert_comparator qualifiedSearch | eval Type=case(len(trim(qualifiedSearch))=4,"Dashboard",len(alert_comparator)=0,"Report",1=1,"Alert") | fields - alert_comparator qualifiedSearch | rename author as Owner title as Title description as Description search as Search dispatch.earliest_time as Earliest_time dispatch.latest_time as Latest_time auto_summarize.cron_schedule as Cron_Schedule action.email.to as Receipients

Re: Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file?

splunkvickyloui — Thu, 11 Feb 2016 03:26:30 GMT

Thanks a lot somesoni2.

this part is not pulling the proper result. Here alert_comparator gives the result as "greater than" and qualifiedsearch displays my search query.

alert_comparator qualifiedSearch | eval Type=case(len(trim(qualifiedSearch))=4,"Dashboard",len(alert_comparator)=0,"Report",1=1,"Alert") | fields - alert_comparator qualifiedSearch

I am trying to pull the alert, report and dashboard details which configured under default search app and other deployed apps.

Thanks in advance.

Re: Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file?

somesoni2 — Thu, 11 Feb 2016 03:44:09 GMT

So the "Reports" and "Alert" categorization is correct but "Dashboard" is not correct?

Re: Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file?

splunkvickyloui — Mon, 15 Feb 2016 18:01:50 GMT

Yes. Reports and Alerts categorizations are correct. Only "Dashboard" categorization shows few currently available dashboards and few currently unavailable dashboards.

Note: Few alerts which scheduled to monitor in real time (rt) was listed as reports. I have changed the real time monitoring to cron scheduled one. Now they are fine.

Thanks for helping me.

Re: Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file?

somesoni2 — Mon, 15 Feb 2016 22:22:20 GMT

The above search is showing scheduled (PDF delivery) dashboards under "Dashboard' category. I guess we can consider them as report. You can get information about the dashboards (forms and dashboards) by using following. Note all fields from above search will not apply to dashboards.

| rest /servicesNS/-/-/saved/searches splunk_server=local | table author title description search dispatch.earliest_time dispatch.latest_time auto_summarize.cron_schedule action.email.to alert_comparator | eval Type=case(len(alert_comparator)=0,"Report",1=1,"Alert") | fields - alert_comparator | append [ | rest /servicesNS/-/-/data/ui/views | table author title description  | eval Type="Dashboard" ] | fillnull value="NA" | rename author as Owner title as Title description as Description search as Search dispatch.earliest_time as Earliest_time dispatch.latest_time as Latest_time auto_summarize.cron_schedule as Cron_Schedule action.email.to as Receipients

Re: Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file?

splunkvickyloui — Thu, 18 Feb 2016 20:42:50 GMT

Thanks again somesoni2. This pulls Report, Alerts and Dashboards. 🙂

But Dashboards are not pulling "Description", Search" and "Recipients". It would be great if you can help me on that as well.

I really appreciate your help on this.

Re: Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file?

somesoni2 — Thu, 18 Feb 2016 21:21:25 GMT

Try this for getting description. The field search and recipients are not applicable to Dashboards (it can have multiple searches and it's not been sent to anyone).

| rest /servicesNS/-/-/saved/searches splunk_server=local | table author title description search dispatch.earliest_time dispatch.latest_time auto_summarize.cron_schedule action.email.to alert_comparator | eval Type=case(len(alert_comparator)=0,"Report",1=1,"Alert") | fields - alert_comparator | append [ | rest /servicesNS/-/-/data/ui/views | rex field=eai:data "\<description\>(?<description>.*)\<\/description\>"| table author title description  | eval Type="Dashboard" ] | fillnull value="NA" | rename author as Owner title as Title description as Description search as Search dispatch.earliest_time as Earliest_time dispatch.latest_time as Latest_time auto_summarize.cron_schedule as Cron_Schedule action.email.to as Receipients

Re: Using Splunk 6.2.1, how do I export the details of configured reports, alerts, and dashboards in an Excel (CSV) file?

puneethgowda — Fri, 30 Jun 2017 19:30:28 GMT

Is it possible to export dashboard with multiple tables into Excel