Getting Data In

Why are report table columns not rendered properly when exporting to PDF or CSV?

Explorer

Hello,

I have a report in table format that I have created and saved. This has the columns that I find useful with useful names. When I press export and select PDF, I just get the time and the raw data. When I select CSV I get all columns available rather than just those shown in my saved report.

Can someone assist?

Thank you

M

Tags (4)
0 Karma
1 Solution

Communicator

I think you need to select explicitely which column you want to keep, and display them in a table.
Add at the end of your search:

| table Time, User, StartTime, EndTime, Duration, Region, City, Country, rDNS, Gateway

View solution in original post

Communicator

I think you need to select explicitely which column you want to keep, and display them in a table.
Add at the end of your search:

| table Time, User, StartTime, EndTime, Duration, Region, City, Country, rDNS, Gateway

View solution in original post

Explorer

This was exactly the solution - thank you!

SplunkTrust
SplunkTrust

What is your report query? Are you using any 'table' or aggregation commands such as stats,chart etc?

0 Karma

Explorer

Here is my search

index=citrix_ns AND "SSLVPN ICAEND_CONNSTAT" | lookup dnslookup clientip AS CitrixNS_SourceIP OUTPUT clienthost AS rDNS | iplocation CitrixNS_SourceIP AS src_ip | rename CitrixNS_user As User CitrixNS_SourceIP As SourceIP CitrixNS_StartTime As StartTime CitrixNS_EndTime As EndTime CitrixNS_Duration As Duration host As Gateway | eval Time=_time | convert ctime(Time)

It won't let me attach a screenshot of the report but i have the columns sorted

_time
User
StartTime
EndTime
Duration
Region
City
Country
rDNS
Gateway

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!