Hi at all,
I noted that in all my forms with Post Process Search, the Export in CSV button is disabled, even if I force it with link.exportResults.visible=true option.
Anyone know if this is expected behavior or I have to modify something?
Thank you.
Bye.
Giuseppe
The export option is not available when you use Post Process feature. You can see this message confirming the same if you mouse hover on the disabled export button in your dashboard. (Taken from Splunk 6.x Dashboard example app -> Post Process example
alt text
The above response will works for me.
We can get our base search job id into "sid" token. Then we can use "| loadjob <sid of search>" splunk command to run our panel without make it base search.
<search id="basesearch">
<query>| makeresults count=1 | streamstats count</query>
<done>
<set token="sid">$job.sid$</set>
</done>
</search>
<panel>
<title>Dashboard panel without use of basesearch</title>
<table>
<title>Can export</title>
<search> <!-- Remove base="<BaseSearch>" from here -->
<query>| loadjob $sid$ | search "user your query here.." </query>
</search>
<option name="drilldown">none</option>
</table>
</panel>
Maybe for someone will be useful:[ How export to csv only 2 rows from base query]
#Workaround Export with Base Search, Post Processing.
1. IN Your dashboard xml
<search id="BASE_SEARCH_EXAMPLE">
<query>
index=_internal sourcetype=* | fields *
</query>
2. Post Procesing query stats base on base search, show only 2 rows.
<Base Search> | stats count by source | head 2
<table>
<title>Post Processing table with 2 rows for export</title>
<search base="BASE_SEARCH_EXAMPLE">
<done>
<set token="start_query_inputlookup">| inputlookup FileForExport.csv</set>
</done>
<query>| stats count by source
| head 2
| outputlookup FileForExport.csv</query>
</search>
<option name="drilldown">none</option>
</table>
3. Hide table with query "| inputlookup FileForExport.csv" and job.sid required for export token $job_exportTocsv$.
<panel depends="$nevershow$">
<table>
<title>Hide table with import query, job.sid required for export.</title>
<search>
<done>
<set token="job_exportTocsv">$job.sid$</set>
</done>
<query>$start_query_inputlookup$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<refreshType>delay</refreshType>
</search>
</table>
</panel>
4. Button or link required for download csv file, paste someware in dashboard.
<table>
</table>
<html>
<a target="_blank" class="btn" href="/api/search/jobs/$job_exportTocsv$/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=FileForExportDetails.csv&outputMode=csv" role="button">Export_Data_csv</a>
</html>
</panel>
One workaround is to use loadjob:
Put this in your base search -
Then use -
| loadjob $baseid$ |
Not sure of the implications for search performance, but it ungrays your download button.
@aldonnelley thanks for your suggestion, I am already using something similar but with named scheduled search which is kind of stupid work-around (because of performance impact) but your idea seems slightly better.
I understand you are dynamically reloading the job resulting from the base search SID but I am not clear (from your explanation) how you do save base search SID into baseid token. Could you please clarify ?
Thanks.
Looks like the code block got stripped.
Set up the base search on your dashboard like this:
<search>
<query>
| myquerygoeshere
</query>
<done>
<set token="sid">$job.sid$</set>
</done>
</search>
then use loadjob to load the base search and extend it as you wish.
@aldonnelley, I was very happy about your idea then I found an unexpected side effect...
In my case, "myquerygoeshere" does include misc. input tokens to dynamically filter dashboard content...
with your proposal, I just realised that the "done" event handler is only executed once. If I do change input contents, the base search is re-evaluated as expected... But "sid" token will stick to its original value.
Any idea how to work-around that ?
Note: I put the filtering logic here because it is common to many panels in my dashboard. So moving and duplicating filtering logic into each panel depending on this base search would not be good.
makes full sense. thanks a lot
As of 01/2019, In Splunk 7.1.2,
Using Bases for Dashboard panel searches still breaks the export functionality.
This has been a known issue for at least three years.
Are there any plans to fix this feature @splunk ?
Any hope to get this feature available for post-process searches as well? It would be really useful.
Old thread I know... but I would like to add my support for this feature.
Ahem. Splunk? Squeak. Bump. raises hand shakes fist
Would love to have this feature as well.
Hello
Me too .
We are also finding this incredibly frustrating
Grr. This is annoying.
This is still an issue today.
Could this function, even if it has to run the search again? Perhaps a dashboard option to enable it, which is off by default? Please?
Ok, I hope that someone in Splunk read these answers!
Is there a workaround? (other than "Open in search")
Thank you.
Giuseppe
This is annoying
Ah, right - that's where I read it 🙂