Download data from dashboard

[Buscatrufas]

Hi guys,

I need download data from my dashboard, how can do it?

Thanks mates 🙂

[Buscatrufas]

My main problem is that don't understand the url to download my file.

For example i use :

curl -ku user:pass http://ip/en-US/api/search/dashboard/dashboard_name -output_mode=csv

but this query throw me an error 404 not found or "This resource can be found at http://127.0.0.1:8000/en-US/account/login?return_to=%2Fen-US%2Fapp%2Fsearch%2Fdashboard%2Fcve_today"

Thanks all for help 🙂

[gfreitas]

Hi Buscatrufas, I don't think you can use curl to download the whole dashboard. A possible sollution would be to do a search via splunk cli and output the results as csv. You can find the docs here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CLIsearchsyntax

[woodcock · Accepted solution]

You can run a search from code in a remote server by using the REST API:

http://dev.splunk.com/restapi
https://answers.splunk.com/answers/232330/how-to-use-the-rest-api-to-just-run-a-search-and-s.html

Alternatively, you can save the search and schedule it to run automatically and after reach run email a copy of the results somewhere. You can then have that system automatically do something with the email.

[gfreitas]

Hi,

You have a few options to accomplish that:

1 - On the dashboard, click on the arrow in the upper right corner of the dashboard (Export PDF option)
2- On the panel that you want the data, click on the arrow that appears when you pass the mouse over the painel and "Export"
3 - On the panel you want to view data, click on the magnifier icon (search), it will open on search, where you can export data as csv and other formats.

[Buscatrufas]

Sorry mate, i explain my answer really bad, can do this by commands or download automatically in my server?

Thanks!

[gfreitas]

Ok, you can also have some options:

1. Use the REST API as described by woodcock bellow
2. Use the email results as described also by woodcock bellow
3. You can append the command "|outputcsv file.csv" to your search and will auto save the results to your Splunk server

Hope this helps