Getting Data In

In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?

Legend

Hi at all,

I noted that in all my forms with Post Process Search, the Export in CSV button is disabled, even if I force it with link.exportResults.visible=true option.

Anyone know if this is expected behavior or I have to modify something?

Thank you.

Bye.

Giuseppe

1 Solution

SplunkTrust
SplunkTrust

The export option is not available when you use Post Process feature. You can see this message confirming the same if you mouse hover on the disabled export button in your dashboard. (Taken from Splunk 6.x Dashboard example app -> Post Process example

alt text
alt text

View solution in original post

Explorer

One workaround is to use loadjob:
Put this in your base search -

$job.sid$

Then use -
| loadjob $baseid$ |

Not sure of the implications for search performance, but it ungrays your download button.

Communicator

@aldonnelley thanks for your suggestion, I am already using something similar but with named scheduled search which is kind of stupid work-around (because of performance impact) but your idea seems slightly better.

I understand you are dynamically reloading the job resulting from the base search SID but I am not clear (from your explanation) how you do save base search SID into baseid token. Could you please clarify ?
Thanks.

0 Karma

Explorer

Looks like the code block got stripped.
Set up the base search on your dashboard like this:

<search>
    <query>
        | myquerygoeshere
    </query>
     <done>
        <set token="sid">$job.sid$</set>
    </done>
</search>

then use loadjob to load the base search and extend it as you wish.

0 Karma

Communicator

@aldonnelley, I was very happy about your idea then I found an unexpected side effect...
In my case, "myquerygoeshere" does include misc. input tokens to dynamically filter dashboard content...

with your proposal, I just realised that the "done" event handler is only executed once. If I do change input contents, the base search is re-evaluated as expected... But "sid" token will stick to its original value.
Any idea how to work-around that ?

Note: I put the filtering logic here because it is common to many panels in my dashboard. So moving and duplicating filtering logic into each panel depending on this base search would not be good.

0 Karma

Communicator

makes full sense. thanks a lot

0 Karma

SplunkTrust
SplunkTrust

The export option is not available when you use Post Process feature. You can see this message confirming the same if you mouse hover on the disabled export button in your dashboard. (Taken from Splunk 6.x Dashboard example app -> Post Process example

alt text
alt text

View solution in original post

Explorer

As of 01/2019, In Splunk 7.1.2,

Using Bases for Dashboard panel searches still breaks the export functionality.

This has been a known issue for at least three years.

Are there any plans to fix this feature @splunk ?

Path Finder

Any hope to get this feature available for post-process searches as well? It would be really useful.

Explorer

Old thread I know... but I would like to add my support for this feature.

0 Karma

Contributor

Ahem. Splunk? Squeak. Bump. raises hand shakes fist

Engager

Would love to have this feature as well.

0 Karma

Path Finder

Hello
Me too .

0 Karma

Engager

We are also finding this incredibly frustrating

0 Karma

Contributor

Grr. This is annoying.

0 Karma

Contributor

This is still an issue today.

Could this function, even if it has to run the search again? Perhaps a dashboard option to enable it, which is off by default? Please?

0 Karma

Legend

Ok, I hope that someone in Splunk read these answers!
Is there a workaround? (other than "Open in search")
Thank you.
Giuseppe

0 Karma

Path Finder

This is annoying

0 Karma

Champion

Ah, right - that's where I read it 🙂

0 Karma

Champion

I don't think this is possible (i.e. you're seeing correct behavior). I believe I had read that somewhere, I just can't seem to find the source at the moment. Also see this older question, the topic discussed there is about Advanced XML, but I think it still applies.

0 Karma