Getting Data In
Highlighted

How to export to csv the search results which used base search?

New Member

I have a dashboard that used base searches which disabled the export button at the bottom of my panels. Is there a simple way I could use to export the results in each panels to csv?

Thanks

Tags (2)
0 Karma
Highlighted

Re: How to export to csv the search results which used base search?

Motivator

Have a look at outputlookup command to export results. For CSV lookups, if the lookup file does not exist, it is created in the lookups directory of the current application. Append |outputlookup file_name.csv to your search. HTH!

0 Karma
Highlighted

Re: How to export to csv the search results which used base search?

Explorer

Using base searches in splunk dashboards breaks the export button feature for the panels.

There are a few workarounds available depending on what your needs are. However none of them will fix the export button on the dashboard.

1) You can use the dump command to output all your search results including the events. This WONT be in CSV

2) @sudosplunk mentioned the outputlookup method; this will write every time the dashboard search is run.

3) You can open the panel in a search and export from there. If you/ the user has the proper permissions this would be the closest to actually exporting from the panel