Dashboards & Visualizations

Can we send the XML dashboard(with multiple panels) link in email scheduled every hour?

chaitanya1996
Engager

Hi all,

We want to add the dashboard(not the PDF) link in the email, so that whenever the user clicks on the link can access the dashboard which displays the data for last 1 hr from the time of generation of email.
Thinking that we can fetch the email generation time as the latest time of dashboard base search through the link present in email message.
suppose
email message : link to dashboard:"//localhost:port/dashboard"
dashboard base search: <query> .....</query> <earliest>-1h</earliest> <latest>$tok$</latest>
this $tok$ in dashboard should fetch the email generation time in supported format.
Is it possible?
correct me with the approach.
please help in achieving this.

0 Karma
1 Solution

ajitshukla61116
Path Finder

Hi @chaitanya1996 ,

try this $job.earliestTime$ - $job.latestTime$ to get earliest and latest time in your alert mail and pass this variable as query parameter in your dashboard URL.

your dashboard link -> link to dashboard:http://localhost:8000/en-US/app/myapp/last1hr?form.earliest=$job.earliestTime$&form.latest=$job.late...

View solution in original post

wmyersas
Builder

Sort of

You could create an Alert

You could schedule a Report

Or you can use the email PDF feature of a dashboard

The last option, if someone clicks on the link in the email, will load the dashboard "now" (though the PDF will be as-of when it was sent)

But Splunk searches are generally intended to be look at "live" (ie relative time window) data, and not "snapshotted" (fixed time window) data (more or less - that's not absolute, there are exceptions, etc)

0 Karma

ajitshukla61116
Path Finder

Hi @chaitanya1996 ,

try this $job.earliestTime$ - $job.latestTime$ to get earliest and latest time in your alert mail and pass this variable as query parameter in your dashboard URL.

your dashboard link -> link to dashboard:http://localhost:8000/en-US/app/myapp/last1hr?form.earliest=$job.earliestTime$&form.latest=$job.late...

chaitanya1996
Engager

Hi @ajitshukla61116 ,

yeah it works fine.
I have used time input field in dashboard with token value as "time" and i have passed the url as: https://localhost:8000/en-US/app//?form.time.earliest=$job.earliestTime$&form.time.latest=$job.lates... in the email message.
thanks.

0 Karma

ajitshukla61116
Path Finder

glad to hear that it work fine 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...