So we have created a Splunk dashboard that everyone loves, it has 11 panels on it each using the time range and other variables from the time picker and drop downs that we have also included on this "incredible" dashboard.
Now the boss wants a pdf delivered each week.
Is there any easy way to convert a form style dashboard to a fixed "dashboard" style so that it can be scheduled to search/render and email a pdf file to interested parties? (like to the boss and business analysts)
We would really just like to lock down the values in the fieldset section and continue to use the existing tokens of the existing dashboard change it from a form to a dashboard. The alternative seems to be to edit the N number of searches and panels which is messy, tedious, and prone to error.
BTW, this could be a great new feature for Splunk. (Maybe it already is and I just don't know about it).
Thanks for reading and I look forward to any pointers.
A non-fixed time frame and a schedule PDF don't really make a lot of sense together.
So the solution is, sort of like you've started to discover, to remove the timepicker and all things associated with it (and other inputs).
A help may be to do what I do in these cases:
Clone that dashboard, on the clone's name put "static" or something so you know it's no longer selectable.
And yes, then go through and reset all the searches to not use the time pickerm, give them each a specific time frame, and *adjust the title* of the chart to reflect that timeframe. "Sales for previous week". Remove any other tokens.
Then remove all the inputs and whatnot.
When you save it, it should now be schedulable.
(Though I'd LOVE to hear someone with a better answer. Maybe you should go to ideas.splunk.com and ... well, search first to see if someone's already asked for this, but if not - maybe create an idea asking for this?)