export dashboard table data via rest

[rohansecadvbot]

Hi, I have a custom dashboard with a table. Below the table is a button which is supposed to call a rest endpoint to send an email.
The reason is , i want to send a HTML email with the contents of the dashboard table, therefore using an external email service.

My question:
What is the best way to send the data from the table on the button click? Is there a way to grab the data rendered in the dashboard table in javascript and call my rest endpoint with it.

Thanks.

[rohansecadvbot · Accepted solution]

The javascript referenced here worked for me.
https://answers.splunk.com/answers/462111/how-to-store-values-in-token-from-specific-cell-of.html

[niketn]

@rohansecadvbot, glad it worked, do upvote the answer you referred as well so that it benefits others.

[baldwintm]

The button could trigger a search that is the same as the dashboard search, but adds “| sendemail” to the end. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sendemail

[rohansecadvbot]

Thanks. I understand that approach. But i want the actual email to be dispatched from some other service (to which i am making a rest call), for reasons cited in my question above. Therefore i want to be able to access the contents of the result from the dashboard in javascript. For example , i can capture a token/parameter using $token$ convention in javascript. Is there a way to capture the query output?

[hurricanelabs]

The query output can be captured using something like $results._raw$ or $results.field$ (for specific fields from the output). Maybe?

[rohansecadvbot]

Thanks @hurricanelabs , that doesn't work. In the example below $user$ is a regular token that renders fine in the display. But $results[0].user$ or _raw does not render the required value. (p.s. tutorials on your site are very useful. I used those to create my custom module).

Search: (search) | table user, severity

My Simple XML panel:

        <b>This is the email template</b>
        <b>$user$, please check and update your system</b>
        <b>$results[0].user$</b>

[niketn]

@rohansecadvbot, I think you will have to adopt opposite approach. Create your own Webpage and connect to Splunk instance using Splunk JS Stack and also pull the data. Finally code your button to push output in an email.

Refer to Splunk Dev documentation on the same: http://dev.splunk.com/view/SP-CAAAEW5

[rohansecadvbot]

Thanks @niketnillay. But my customers would rather interact with one UI and since they do most of the work in splunk, sending them to another webpage for email seems like overkill. I am looking for a way to get the data in the splunk side js and only send the required fields for email (like email addresses from a query).