All Apps and Add-ons

Can we group all the panels in a dashboard as one and download all of them at once in sideview editor?

shrey12
Explorer
0 Karma

sideview
SplunkTrust
SplunkTrust

OK. restating your question a bit here - "on my dashboard there are lots of panels each with a SearchControls module. Is there a way the user can effectively download csv output for all of the results for all of them at once?"

The answer I'm afraid is not really. You could technically do some strange things with the append and loadjob command, to basically glom all the rows of the 25 searches together into one super-result. However the columns are presumably different from report to report and even if they weren't I think the resulting mismash.csv would be pretty confusing.

However... there may be another solution. the fact that you're asking this question at all suggests that the 25 searches are at least thematically similar, and that the search language may be pretty similar. It may be feasible to refactor the dashboard so as to use the PostProcess mechanism. In this way there could be only one base search involved, and thus one set of "base search results", and 25 different postprocess searches could carve different slices out of this high-dimensional dataset, so as to render each of the 25 panels. 25 is a big number for this... However it's quite possible to break it up into 2 or 3 base searches. What I'm thinking is that you could get down to 2 or 3 SearchControls modules instead of 25...

Either way getting there will involve sharing your dashboard XML as well as the full search language. It may be more of a slogfest than is palatable for you to be honest. Postprocess refactoring is a pretty advanced topic in Splunk (Read in Sideview Utils "Key Techniques > PostProcess > An Introduction to PostProcess")

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm afraid I do not understand this question. When you edit a dashboard in the Sideview Editor you have the ability to edit any of the panels therein.

Do you perhaps mean that there is some repeated block of XML and you wish to avoid editing the multiple copies? If so please post the XML somewhere like pastebin - it's possible that the repetition itself can be eliminated.

0 Karma

shrey12
Explorer

I have 25 panels in a dashboard. I want to be able to download all of them at once instead of downloading one panel at a time

0 Karma

sideview
SplunkTrust
SplunkTrust

Just not sure what you mean by download. Do you mean that navigating around in the schematic view is tedious and time consuming? As sub-branches of the config appear and dissappear in the schematic view they're not technically downloading anything but I can see why it might look that way.

Can you post your XML? It's possible that it's unnecessarily nested and by removing/simplifying/refactoring it, it could become a bit less verbose.

0 Karma

shrey12
Explorer

by download I mean saving the dashboard it in any specific format !

0 Karma

sideview
SplunkTrust
SplunkTrust

Do you mean that each panel has a download button or a SearchControls module? And that you wish to give the user the ability to effectively download all of the results for all 25 searches at once? If so, sorry I thought this was a question about the Sideview Editor specifically.

0 Karma

shrey12
Explorer

yes thats exactly what i wanted to do . sorry for the confusion

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...