Dashboards & Visualizations

How to export a table filtered through dashboard as CSV?

srive326
Explorer

Hello,

I created a dashboard that works as a tool to filter a much larger report.

For example, I'm using inputs/dropdown menus to filter by different columns. When I go to export the table that's been filtered with the dashboard, the icon to export as CSV is disabled. I'm writing to ask if there's a way to work around this?

I know that this question has been asked but most of the threads I see on this question are many years old which is why I wanted to ask again in case anything has changed.

Thank you for your help. 

Labels (1)
Tags (3)
0 Karma
1 Solution

niketnilay
Legend

Not as of now but may be with the New Dashboard Framework.

Meanwhile loadjob could be an option to use results to power you panels that can be downloaded instead of Post-Processing. Panels powered by loadjob offer download option but drilldown can not be set to original search SPL (directly, there can be workaround to pass original SPL as drilldown).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

genesiusj
Builder

First I apologize for having any "attitude" around this. From the little I have read, this is a problem that has been around for at least 3 years. And from what I have read, the Splunk techs have not repaired. If I am mistaken and they have, please advise. Otherwise, read on.

The solutions I have read about clicking the search instead and exporting from there is not REALLY a solution. The reason for using a base search, at least from my POV, is to speed up the displaying of data on a dashboard with multiple panels. Having to open a separate search tab for each panel defeats the purpose of using a base search because each 5, 10, 15, 20 min+ search has to run all over again.  The other workaround of using saved searches and loads likewise defeats the purpose of using a base search. Splunk should stop offering "workarounds" and fix the issue. 

In the meantime, I have come up with a "work-around" that I now unfortunately have to implement.

Add the following text input and option to your dashboard code. 

 

  <fieldset submitButton="false" autoRun="false">
    <input type="text" token="tok_rowsPerTable" searchWhenChanged="true">
      <label>Rows per Table>
      <default>10</default>
    </input>
  </fieldset>

<option name="count">$tok_rowsPerTable$</option>

 

Note: You can add the input to each panel, just before the <table> tag. Remember to remove the <fieldset> and </fieldset> tags first.

You will click and drag the table cells and then copy and paste them into an Excel file. I know this is a drag, pun intended, but it is the only efficient workaround I have found to reduce the time it would take to open a search for each of my 20 panels.

And if any customers are developers, please create a permanent code fix that the Splunk techs can implement. And if they won't implement it, at least the Splunk community can use it.

Again, if this has already been resolved and I missed it somewhere, please advise.

Thanks and God bless,

Genesius

0 Karma

niketnilay
Legend

Not as of now but may be with the New Dashboard Framework.

Meanwhile loadjob could be an option to use results to power you panels that can be downloaded instead of Post-Processing. Panels powered by loadjob offer download option but drilldown can not be set to original search SPL (directly, there can be workaround to pass original SPL as drilldown).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

anilchaithu
Builder

@srive326 

The import option is disabled when you use base search in the dashboard/form. If you really need this report to be downloaded and base search is not essentially required, try without base search.

other option would be click on the search icon-> pops up a new tab with the search -> import.

 

 

Tags (1)
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!