Re: Why export option is not downloading the searc...

812456 · ‎05-16-2020

Hi i am new to Splunk,
Export option is used using below code <a class="btn btn-primary" role="button" href="/api/search/jobs/$export_sid$/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=Input&outputMode=csv">Export</a>
Issue:
Search results are not exporting as CSV file, default value (i.e. ) is downloading for search results too.
this issue occurs when i use base search option in code. what will be solution if i use export option with base search. kindly help to resolve this issue.
**Note:* Here base search is mandatory for us.because export option is working properly without base search.

<form>
  <label>Product</label>
  <init>
    <set token="ProductNo">*</set>
    <set token="TproductNo">*</set>
  </init>
  <search>
    <query>| makeresults | eval x=if($ProductNo$==1,"1","2")</query>
    <done>
      <condition match="$result.x$==&quot;1&quot;">
        <set token="ProductNo">*</set>
        <set token="TproductNo">*</set>
      </condition>
      <condition>
        <unset token="TproductNo"></unset>
        <eval token="TproductNo">substr($ProductNo$,1,len($ProductNo$)-2)</eval>
      </condition>
    </done>
  </search>
  <search id="baseSearch">
    <query> source="log.2020-04-22" host="LTPCHE10CTA0405" | xmlkv maxinputs=10000 | rex field=_raw "((?<Type>(\w*))\s(?<Code>(\d+))\s((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]))\s(?<TimeStamp>(\d{8}\s\d{6}))\s(?<TextMsg>([\w\s]+).*))" | rex field=TextMsg "([\w\s]*\W\s*(?<TrkNo>\d+)\s*(,)*(?<Msg2>[\w\s]*.*))" | rex field=TextMsg "((?<Msg1>([\w\s]*))\W\s*)" | rex field=TextMsg "(Before NO =    Trk No =    (?<TPTrkNo>\d+))" | rename "ts:productname" as productname "ts:productNo" as productNo | eval TLogTimeStamp=strftime(strptime(LogTimeStamp,"%Y%m%d%H%M%S"),"%m/%d/%Y %H:%M:%S %p") </query>
  </search>
  <fieldset submitButton="true">
    <input type="text" token="ProductNo">
      <label>Tracking No</label>
      <default></default>
      <change>
        <condition value="">
          <set token="ProductNo">1</set>
          <unset token="TproductNo"></unset>
        </condition>
      </change>
    </input>
    <input type="checkbox" searchWhenChanged="true" token="xmlCheckBox">
      <label>Raw Data</label>
      <choice value="1">On</choice>
      <change>
        <condition match="$xmlCheckBox$==&quot;1&quot;">
          <set token="xmlToken">1</set>
          <unset token="tkninputPanel">0</unset>
        </condition>
        <condition>
          <set token="tkninputPanel">1</set>
          <unset token="xmlToken">0</unset>
        </condition>
      </change>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel depends="$tkninputPanel$">
      <html depends="$export_button$">
        <a class="btn btn-primary" role="button" href="/api/search/jobs/$export_sid$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=Input&amp;outputMode=csv">Export</a>
        </html>
      <table id="table1">
       <search base="baseSearch">
          <query> search TrkNo=$ProductNo$ OR TPTrkNo=$TproductNo$ 
| table Type TLogTimeStamp MsgCode TrkNo Msg1 Msg2 productname productNo
BWTextMsg | sort -TLogTimeStamp 
        </query>
         <done>
            <set token="export_sid">$job.sid$</set>
            <set token="export_button">1</set>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>

<panel depends="$xmlToken$">
      <title>XML Results</title>
        <html depends="$exportXML_button$">
          <a class="btn btn-primary" role="button" href="/api/search/jobs/$exportXML_sid$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=InputXML.txt&amp;outputMode=csv">Export</a>
        </html>
      <table id="table2">
        <search base="baseSearch">
          <query>
            search TrkNo=$ProductNo$ OR TPTrkNo=$TproductNo$            
          | table TrkNo TLogTimeStamp Msg1 _raw | sort -TLogTimeStamp
        </query>
          <done>
            <set token="exportXML_sid">$job.sid$</set>
            <set token="exportXML_button">1</set>
          </done>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>    
  </row>
</form>

gcusello · ‎05-17-2020

Hi @812456,
it's a normal behaviour, i don't know why!
I can suggest as workaround to open the panel in search, so you can export csv,

Ciao.
Giuseppe

Why export option is not downloading the search result when i use basesearch?

other

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Part 1: A Guide to Maximizing Splunk IT Service Intelligence