Can we send the XML dashboard(with multiple panels) link in email scheduled every hour?

[chaitanya1996]

Hi all,

We want to add the dashboard(not the PDF) link in the email, so that whenever the user clicks on the link can access the dashboard which displays the data for last 1 hr from the time of generation of email.
Thinking that we can fetch the email generation time as the latest time of dashboard base search through the link present in email message.
suppose
email message : link to dashboard:"//localhost:port/dashboard"
dashboard base search: <query> .....</query> <earliest>-1h</earliest> <latest>$tok$</latest>
this $tok$ in dashboard should fetch the email generation time in supported format.
Is it possible?
correct me with the approach.
please help in achieving this.

[wmyersas]

Sort of

You could create an Alert

You could schedule a Report

Or you can use the email PDF feature of a dashboard

The last option, if someone clicks on the link in the email, will load the dashboard "now" (though the PDF will be as-of when it was sent)

But Splunk searches are generally intended to be look at "live" (ie relative time window) data, and not "snapshotted" (fixed time window) data (more or less - that's not absolute, there are exceptions, etc)

[ajitshukla61116 · Accepted solution]

Hi @chaitanya1996 ,

try this $job.earliestTime$ - $job.latestTime$ to get earliest and latest time in your alert mail and pass this variable as query parameter in your dashboard URL.

your dashboard link -> link to dashboard:http://localhost:8000/en-US/app/myapp/last1hr?form.earliest=$job.earliestTime$&form.latest=$job.late...

[chaitanya1996]

Hi @ajitshukla61116 ,

yeah it works fine.
I have used time input field in dashboard with token value as "time" and i have passed the url as: https://localhost:8000/en-US/app//?form.time.earliest=$job.earliestTime$&form.time.latest=$job.lates... in the email message.
thanks.

[ajitshukla61116]

glad to hear that it work fine 🙂