Render Dashboard to PDF with time range - REST API

[Ethil]

Hello everyone, and thanks in advance for your help. I'm very new to this subject so if anything is unclear, i'll try to explain my problem more in details.

I'm using spunk 9.2.1, and i'm trying to generate a PDF from one of my dashboard on the last 24 hours, using a splunk API call.

I'm using a POST request to the ".../services/pdfgen/render" endpoint. First I couldn't find any documentation on  this matter. Furthermore, even when looking at $SPLUNK_HOME/lib/python3.7/sites-packages/splunk/pdf/pdfgen_*.py  (endpoint,views,search,utils) i could'nt really understand what arguments to use to ask for the last 24 hours data. I know it should be possible because it is doable on the splunk GUI, where you can choose a time range and render according to it. 

I saw something looking like time range args : et and lt, which should be earliest time and latest time, but i don't know what type of time data it is expecting an trying random things didn't get me anywhere.

If you know anything on this subject please help me 🙂

thank you

[tscroggins]

Hi @Ethil,

As far as I can tell, the et and lt query parameters are only used with input-search and not input-dashboard etc.

[Ethil]

Hi @tscroggins , 

Thanks for your reply, then do you perhaps know if they're any time-range args that work with input-dashboard ? Otherwise, should i use another method ?

[tscroggins · Accepted solution]

Hi @Ethil,

To include time values from form inputs, SplunkWeb sends a rendered version of the dashboard XML to the pdfgen service.

For example, given the Simple XML source:

<form version="1.1" theme="light">
  <label>my_dashboard</label>
  <fieldset submitButton="false">
    <input type="time" token="time_tok">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| addinfo</query>
          <earliest>$time_tok.earliest$</earliest>
          <latest>$time_tok.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

View the dashboard in SplunkWeb and change the time range to Earliest: -1h@h and Latest: @h.

When you export the dashboard to PDF, SplunkWeb renders the following static dashboard:

<dashboard>
  <label>my_dashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| addinfo</query>
          <earliest>-1h@h</earliest>
          <latest>@h</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</dashboard>

Note that the form element is now a dashboard element, the fieldset element has been removed, and the time_tok.earliest and time_tok.latest token values have been propagated to the search earliest and latest elements.

The dashboard is then XML-encoded:

<dashboard>
  <label>my_dashboard</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| addinfo</query>
          <earliest>-1h@h</earliest>
          <latest>@h</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</dashboard>

Finally, the result is sent to the pdfgen service using the URL-encoded input-dashboard-xml parameter, illustrated here using curl over the management port (SplunkWeb uses a SplunkWeb endpoint) with line breaks removed:

curl -k -u admin -o my_dashboard_last_hour.pdf https://localhost:8089/services/pdfgen/render --data-urlencode 'input-dashboard-xml=<dashboard><label>my_dashboard</label><row><panel><table><search><query>| makeresults | addinfo</query><earliest>-1h@h</earliest><latest>@h</latest></search><option name="drilldown">none</option><option name="refresh.display">progressbar</option></table></panel></row></dashboard>'

You can pass any static Simple XML to the pdfgen service; it doesn't need to be associated with a saved dashboard:

curl -k -u admin -o hello.pdf https://localhost:8089/services/pdfgen/render --data-urlencode 'input-dashboard-xml=<dashboard><label>Hello, World!</label></dashboard>'

[Ethil]

Thanks a lot for your help !