Dashboards & Visualizations

No option to Export CSV results from dashboard UI app view????????

r999
Path Finder

I have created a simple UI dashboard app, which has a simple form based search and is locked down so the user cannot drill down to results and therefore get open access to the search bar.

However i would like them to be able to export the table of results to a CSV.

Unfortunately the Actions menu only has Print and a greyed out PDF option as the PDF server is not configured. some answers post seem to suggest this is not pssible? can someone confirm?

I am using Advanced XML, cann i not add in a exportCSV module somehow?

Thanks

1 Solution

jonuwz
Influencer

Just stick the export module within the search with your simpleresults table.

<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">* | head 10 | table sourcetype source _time</param>
  <module name="Export">
    <param name="exportType">result</param>
  </module>
  <module name="SimpleResultsTable"/>
</module>

Edited to make SRT + Export siblings as suggested by Sideview

View solution in original post

koshyk
Super Champion

You could save the search as a "Report" rather than a "Dashboard".
Report gives option for Export as CSV,XML, PDF etc..

0 Karma

jonuwz
Influencer

Just stick the export module within the search with your simpleresults table.

<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">* | head 10 | table sourcetype source _time</param>
  <module name="Export">
    <param name="exportType">result</param>
  </module>
  <module name="SimpleResultsTable"/>
</module>

Edited to make SRT + Export siblings as suggested by Sideview

sideview
SplunkTrust
SplunkTrust

I forgot they added an Export module. I'll update my answer too. Btw there's no need to have the SimpleResultsTable nested inside like that. Just have the Export and SimpleResultsTable be siblings at the same level.

kranthimutyala
Path Finder

where i need to add this module exactly in the xml, because i getting warnings

0 Karma

niketn
Legend

@kranthimutyala you are referring to a post from 7 years ago. Advanced XML stands deprecated from several releases 6.4 or even prior. Please create a new question with your issue for the community to assist you better.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mark_chuman
Path Finder

what do you mean by stick the export module within the search? Just paste it in after your search after a pipe?

sideview
SplunkTrust
SplunkTrust

1) There's an app called Splunk for Excel Export that gives you a module called ExcelExport.

It overdelivers in this case, because it sends headers that office recognizes such that excel will itself open directly, and the data will stream down into Microsoft Excel directly (oooh).

2) If you're just after a simpler CSV export, I think in Core splunk you have to use the TitleBar module, and you have to make sure to place that TitleBar module into a place in the hierarchy where it has access to the given dispatched search. ie place it as a sibling of your JobProgressIndicator or FlashChart. At any rate no higher than the deepest module "that needs a search to be running". And it'll bring along with it the pagetitle and the actions menu and all of the options in the actions menu, less whatever you can whack away or grey out by setting some params to false.

3) Or you can use Sideview Utils, which has a module called SearchControls. You have to be just as mindful of placement in the XML hierarchy as with TitleBar. However with SearchControls you (the view creator) can choose from lots of buttons and menus. Basically it's the stuff that the JobStatus module can do, plus export. And you can control exactly what buttons and menus SearchControls has, and in what order.

So if you just want it to put an export button on the page you would do

<module name="SearchControls">
  <param name="sections">export</param>
</module>

If you go with #3, make sure to get Sideview Utils from the sideview site and not from Splunkbase. The version on Splunkbase is really old and among many other differences, it doesn't have the SearchControls module.

http://sideviewapps.com/apps/sideview-utils/

UPDATE -- as jonuwz pointed out, there is a module called Export in the core Splunk UI and you can use that to give you a simple export button that will bring up the little export controls when clicked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...