Dashboards & Visualizations

How to schedule an excel report based on an existing dashboard?

Dyana_a
Explorer

Hi!

I would like to anyone has scheduled an excel report based on an existing dashboard?

I have create a dashboard that contains only one drop down in which the user will choose a single location.

Then the dashboard displays the counts based on that location.

Now I'd like to know if there's an easy way to have all that data (per location), and add them in one single Excel file. For example

The dashboard looks like this:

Location dropdown: All, Avenue1, Avenue2, Avenue3....

Displaying:
Panel 1
Panel 2
Panel 3

Dyana_a_1-1678118934344.png

Each panel is coming from 4 saved searches for that particular location, and it returns the numbers for WTD, MTD, QTD and YTD then appending the numbers to create the columns.

I'd like to know if I can create an Excel file from this Dashboard that can be scheduled to run daily.

In other words, for each location: All locations, Avenue1, Avenue2, and so on, it can be written into one single Excel (if that cannot be done, at least get each location per Excel file).  In that case, I'd have to create 7 Excel files (1 file per location) that will contain the different panels per location.

What I was envisioning it follow but I don't know if it's possible.

Dyana_a_2-1678119243882.png

If anyone knows how I can approach this problem, it would be great or if they have a suggestion, a workaround, would be great too.

Thank you so much in advance.

 

Dyana

 

 

 



 

Labels (4)
0 Karma
1 Solution

Gr0und_Z3r0
Contributor

Hi @Dyana_a 

You can try something like this....
Perform union operation as your columns are same and insert text info for different segments of your report.

| makeresults count=5
| eval PROD_DESCRIPTION="Product " . tostring(_time + random() * 1000)
| eval WTD=random()*100, MTD=random()*1000, QTD=random()*10000, YTD=random()*100000
| table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
| addcoltotals label=PROD_TOTAL labelfield=PROD_DESCRIPTION
| union 
[ 
    | gentimes start=-1 end=0
    | eval PROD_DESCRIPTION=""
    | eval WTD="", MTD="", QTD="", YTD=""
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    
]
| union 
[ 
    | gentimes start=-1 end=0
    | eval PROD_DESCRIPTION="AVENUE-1"
    | eval WTD="", MTD="", QTD="", YTD=""
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    
]
| union [ 
    | makeresults count=5
    | eval PROD_DESCRIPTION="Another product " . tostring(_time + random() * 1000)
    | eval WTD=random()*100, MTD=random()*1000, QTD=random()*10000, YTD=random()*100000
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    | addcoltotals label=PROD_TOTAL labelfield=PROD_DESCRIPTION
]
| union 
[ 
    | gentimes start=-1 end=0
    | eval PROD_DESCRIPTION="Avenue-2"
    | eval WTD="", MTD="", QTD="", YTD=""
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    
]
| union 
[ 
    | gentimes start=-1 end=0
    | eval PROD_DESCRIPTION=""
    | eval WTD="", MTD="", QTD="", YTD=""
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    
]| union [ 
    | makeresults count=5
    | eval PROD_DESCRIPTION="Another product " . tostring(_time + random() * 1000)
    | eval WTD=random()*100, MTD=random()*1000, QTD=random()*10000, YTD=random()*100000
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    | addcoltotals label=PROD_TOTAL labelfield=PROD_DESCRIPTION
]

 

Gr0und_Z3r0_1-1680003527067.png

 

 


~ If the reply helps a karma upvote would be appreciated.

View solution in original post

Dyana_a
Explorer

This was incredibly helpful thank you so much and have a wonderful day!

0 Karma

Gr0und_Z3r0
Contributor

Hi @Dyana_a 

You can try something like this....
Perform union operation as your columns are same and insert text info for different segments of your report.

| makeresults count=5
| eval PROD_DESCRIPTION="Product " . tostring(_time + random() * 1000)
| eval WTD=random()*100, MTD=random()*1000, QTD=random()*10000, YTD=random()*100000
| table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
| addcoltotals label=PROD_TOTAL labelfield=PROD_DESCRIPTION
| union 
[ 
    | gentimes start=-1 end=0
    | eval PROD_DESCRIPTION=""
    | eval WTD="", MTD="", QTD="", YTD=""
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    
]
| union 
[ 
    | gentimes start=-1 end=0
    | eval PROD_DESCRIPTION="AVENUE-1"
    | eval WTD="", MTD="", QTD="", YTD=""
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    
]
| union [ 
    | makeresults count=5
    | eval PROD_DESCRIPTION="Another product " . tostring(_time + random() * 1000)
    | eval WTD=random()*100, MTD=random()*1000, QTD=random()*10000, YTD=random()*100000
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    | addcoltotals label=PROD_TOTAL labelfield=PROD_DESCRIPTION
]
| union 
[ 
    | gentimes start=-1 end=0
    | eval PROD_DESCRIPTION="Avenue-2"
    | eval WTD="", MTD="", QTD="", YTD=""
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    
]
| union 
[ 
    | gentimes start=-1 end=0
    | eval PROD_DESCRIPTION=""
    | eval WTD="", MTD="", QTD="", YTD=""
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    
]| union [ 
    | makeresults count=5
    | eval PROD_DESCRIPTION="Another product " . tostring(_time + random() * 1000)
    | eval WTD=random()*100, MTD=random()*1000, QTD=random()*10000, YTD=random()*100000
    | table PROD_DESCRIPTION, WTD, MTD, QTD, YTD
    | addcoltotals label=PROD_TOTAL labelfield=PROD_DESCRIPTION
]

 

Gr0und_Z3r0_1-1680003527067.png

 

 


~ If the reply helps a karma upvote would be appreciated.

Dyana_a
Explorer

This worked perfectly! thank you

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...