topic Re: Timechart - Use HTML Settings for a Scheduled report in Dashboards & Visualizations

Timechart - Use HTML Settings for a Scheduled report

chrisschum — Fri, 03 May 2019 12:24:51 GMT

Is there a way to schedule PDF delivery of a dashboard that has specific HTML settings?

My issue is that when I try and schedule PDF delivery of a Dashboard, when I schedule it, the search is converted to simply '| noop'

If I try and create a new report with the data, it automatically creates a Bar Chart based (not the Line Chart I want) based on the search and also doesn't use the specific colors I want to use.

The search is below.

Thanks!!!

Re: Timechart - Use HTML Settings for a Scheduled report

chrisschum — Fri, 03 May 2019 12:38:02 GMT

 <title>Vulnerability Remediation Activity Across All Applications - No Tier  - Past 90 Days</title>
      <chart>
        <search>
          <query>index=index_app sourcetype="app:detection" NOT severity IN (low, informational), STATUS IN (FIXED, ACTIVE, NEW, RE-OPENED) NOT Tier IN (0,1,2)
          | rename DNS AS Hostname
          | eval "NEW" = "NEW" + ";" + "RE-OPENED"
          | makemv delim=";" "NEW"
          | mvexpand NEW
          | timechart span=1mon count(STATUS) by STATUS usenull=f
          | fields - "RE-OPENED"</query>
          <earliest>-90d@d</earliest>
          <latest>-1h</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisLabelsY.majorUnit">auto</option>
        <option name="charting.axisLabelsY2.majorUnit">100</option>
        <option name="charting.axisTitleX.text">Time Period</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">auto</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">auto</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.maximumNumber">auto</option>
        <option name="charting.axisY2.minimumNumber">auto</option>
        <option name="charting.axisY2.scale">linear</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{FIXED:0x00cc66, ACTIVE:0xff4d4d, NEW:0x1a66ff}</option>
        <option name="charting.layout.splitSeries">1</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">1</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">seriesCompare</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trellis.splitBy">severity</option>
      </chart>

Re: Timechart - Use HTML Settings for a Scheduled report

niketn — Sat, 04 May 2019 04:27:56 GMT

@chrisschum if instead of Dashboard you use a Scheduled Saved Search you can change the Saved Search configuration to set the color option. Refer to the following answer with the available option with saved search.

https://answers.splunk.com/answers/582632/how-do-you-use-custom-xml-in-reports-from-dashboar.html

Re: Timechart - Use HTML Settings for a Scheduled report

woodcock — Sat, 04 May 2019 19:34:39 GMT

Have you tried the apps?
https://splunkbase.splunk.com/app/4030/
https://splunkbase.splunk.com/app/4132/

Re: Timechart - Use HTML Settings for a Scheduled report

chrisschum — Mon, 06 May 2019 14:38:51 GMT

Thanks woodcock. Unfortunately, I'm not in a position where I can install any apps on our Splunk instance.

Re: Timechart - Use HTML Settings for a Scheduled report

chrisschum — Mon, 06 May 2019 14:45:19 GMT

I think that's the ticket niketnilay! It seems to have worked. Thanks!