Hi,
I have a dashboard with some panels. Only in one of the panels, the Export button (the one next to the Open in Search, Inspect and Refresh buttons) is grayed out.
In other dashboards i created, this button is grayed out in all panels.
The problem occurs to all users, including admins.
What can be the cause for this?
are some panels created with a post process? if there is a base search attributing to some panels, you aren't able to export the panel itself, only open it in search, inspect and refresh. it is a drawback, in my opinion, to post processing, and should be an enhancement.
The above response will works for me.
We can get our base search job id into "sid" token. Then we can use "| loadjob <sid of search>" splunk command to run our panel without make it base search.
<search id="basesearch">
<query>| makeresults count=1 | streamstats count</query>
<done>
<set token="sid">$job.sid$</set>
</done>
</search>
<panel>
<title>Dashboard panel without use of basesearch</title>
<table>
<title>Can export</title>
<search> <!-- Remove base="<BaseSearch>" from here -->
<query>| loadjob $sid$ | search "user your query here.." </query>
</search>
<option name="drilldown">none</option>
</table>
</panel>
Like mentioned by other, below usage will disable the export option.
<search base="YourBaseSearch">
<query>
| search customkey="search filter"
</query>
Workaround:
Instead use the saved search as below will enable the download link
<search>
<query>
| savedsearch YourBaseSearchName
| search customkey="search filter"
....
</query>
</search>
However the savedsearch workaround defects the purpose of using base search. In my case the similar SPL is used multiple times so I have to use base search to optimize the dashboard. However, instead of that if I have to use SavedSearch at each place then its not giving any benefit in terms of performance.
Splunk is very slow to fix this issue which is being there for long time. They should provide some alternative not at the cost of performance.
Is it fixed for export button is grayed out for base dashboard or post press search?
Thank you,Is it fixed for post press search for download arrow grey out
As of today (April 29, 2020) post process panels export button is still greyed out.
IS there any workaround for this issue? How can a product be so much constrained and not fixed the problem for long time? Splunk what is your plan for this?
are some panels created with a post process? if there is a base search attributing to some panels, you aren't able to export the panel itself, only open it in search, inspect and refresh. it is a drawback, in my opinion, to post processing, and should be an enhancement.
One option is to click in the hour glass next to the down arrow. It will open the search on a new window and you can download it from there.
That is not hour glass i think. its magnifying glass icon which also looks like a badminton racket.
It is still an issue in 8.0.1
definitely would like to see this fixed!
This x1000. Needs to be changed by Splunk.
@grittonc maybe check out Splunk Next Beta announced by Splunk at .Conf 2018 which had Splunk Developer Cloud and SPL v2.
https://www.splunk.com/blog/2018/10/03/new-for-developers-splunk-developer-cloud-more.html
As of 01/2019, In Splunk 7.1.2,
Using Bases for Dashboard panel searches still breaks the export functionality.
This has been a known issue for at least three years based off: https://answers.splunk.com/answers/367069/in-all-my-forms-with-post-process-search-the-expor.html
Are there any plans to fix this feature @splunk ?
You are right, only in panels without a base search the Export button is enabled...
Splunk should do something about it! I can't give up on post processing.
Thank you!
This definitely needs to be addressed. Reduces the value of base search setup.
It is now nearing the end of 2021. Splunk 8.2.1 still has the same problem. Is there any movement by Splunk to correct this major flaw?
I read the post about "to click and open it in search" The issue is we do not want users at the search bar, so we disable the search icon on the dashboard. We rely on the download action to be available for the user to collect information off of any panel.
Splunk please consider correcting this issue.
Is this corrected in Splunk 9? Will it ever be corrected? Can someone please answer to this issue?
It still grayed out on Splunk Enterprise 9.0.1 when using a post process search.
There is a workaround mentioned by @gjanders in a Splunk Ideas comment about this issue involving the use of the loadjob command.
https://ideas.splunk.com/ideas/EID-I-1937
Here is the comment:
Consider this example for a base/post-process search:
<search id="basesearch">
<query>| makeresults count=1 | streamstats count</query>
<done>
<set token="sid">$job.sid$</set>
</done>
</search>
<row>
<panel>
<title>loadjob of basesearch</title>
<table>
<title>Can export</title>
<search>
<query>| loadjob $sid$</query>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
That should do what you expect, note that the loadjob isn't technically the same as a post-process search but you can use to achieve the same goal...