Other Usage

Why export button is grayed out in some of my panels?

lior_g
Explorer

Hi,

I have a dashboard with some panels. Only in one of the panels, the Export button (the one next to the Open in Search, Inspect and Refresh buttons) is grayed out.
In other dashboards i created, this button is grayed out in all panels.
The problem occurs to all users, including admins.

What can be the cause for this?

Labels (1)
Tags (4)
1 Solution

cmerriman
Super Champion

are some panels created with a post process? if there is a base search attributing to some panels, you aren't able to export the panel itself, only open it in search, inspect and refresh. it is a drawback, in my opinion, to post processing, and should be an enhancement.

View solution in original post

RaviNandasana0
Explorer

The above response will works for me. 
We can get our base search job id  into "sid"  token.  Then we can use  "| loadjob  <sid of search>"  splunk command to run our panel without make it base search.

<search id="basesearch">
  <query>| makeresults count=1 | streamstats count</query>
  <done>
    <set token="sid">$job.sid$</set>
  </done>
</search>

 

  <panel>
    <title>Dashboard panel without use of basesearch</title>
    <table>
      <title>Can export</title>
      <search>    <!-- Remove base="<BaseSearch>" from here -->
        <query>| loadjob $sid$ | search "user your query here.." </query>
      </search>
      <option name="drilldown">none</option>
    </table>
  </panel>

 

0 Karma

TVS
New Member

Like mentioned by other,  below usage will disable the export option.

<search base="YourBaseSearch">
<query>
| search customkey="search filter"
</query>

Workaround:

Instead use the saved search as below will enable the download link

<search>
<query>
| savedsearch YourBaseSearchName
| search customkey="search filter"
....
</query>
</search>

 

0 Karma

santosh_sshanbh
Path Finder

However the savedsearch workaround defects the purpose of using base search. In my case the similar SPL is used multiple times so I have to use base search to optimize the dashboard. However, instead of that if I have to use SavedSearch at each place then its not giving any benefit in terms of performance.

Splunk is very slow to fix this issue which is being there for long time. They should provide some alternative not at the cost of performance.

webexpert
New Member

Is it fixed for export button is grayed out for base dashboard or post press search?

Thank you,Is it fixed for post press search for download arrow grey out

0 Karma

anwarmian
Communicator

As of today (April 29, 2020) post process panels export button is still greyed out.

0 Karma

santosh_sshanbh
Path Finder

IS there any workaround for this issue? How can a product be so much constrained and not fixed the problem for long time? Splunk what is your plan for this?

0 Karma

cmerriman
Super Champion

are some panels created with a post process? if there is a base search attributing to some panels, you aren't able to export the panel itself, only open it in search, inspect and refresh. it is a drawback, in my opinion, to post processing, and should be an enhancement.

anwarmmian
Explorer

One option is to click in the hour glass next to the down arrow. It will open the search on a new window and you can download it from there.

0 Karma

AKJK
Observer

That is not hour glass i think. its magnifying glass icon which also looks like a badminton racket.

0 Karma

donelliot
Path Finder

It is still an issue in 8.0.1

0 Karma

mbrunetto
Path Finder

definitely would like to see this fixed!

0 Karma

grittonc
Contributor

This x1000. Needs to be changed by Splunk.

0 Karma

niketn
Legend

@grittonc maybe check out Splunk Next Beta announced by Splunk at .Conf 2018 which had Splunk Developer Cloud and SPL v2.

https://www.splunk.com/blog/2018/10/03/new-for-developers-splunk-developer-cloud-more.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

fsolercasanova
Explorer

As of 01/2019, In Splunk 7.1.2,

Using Bases for Dashboard panel searches still breaks the export functionality.

This has been a known issue for at least three years based off: https://answers.splunk.com/answers/367069/in-all-my-forms-with-post-process-search-the-expor.html

Are there any plans to fix this feature @splunk ?

lior_g
Explorer

You are right, only in panels without a base search the Export button is enabled...
Splunk should do something about it! I can't give up on post processing.

Thank you!

mschellhouse
Path Finder

This definitely needs to be addressed. Reduces the value of base search setup.

cinsley
Explorer

It is now nearing the end of 2021.  Splunk 8.2.1 still has the same problem.   Is there any movement by Splunk to correct this major flaw?

cinsley
Explorer

I read the post about  "to click and open it in search"  The issue is we do not want  users at the search bar, so we  disable the search icon on the dashboard.  We rely on the download action to be available for the user to collect information off of any panel.

Splunk please consider correcting this issue.

0 Karma

cinsley
Explorer

Is this corrected in Splunk 9?    Will it ever be corrected?   Can someone please answer to this issue?

0 Karma

joshiro
Communicator

It still grayed out on Splunk Enterprise 9.0.1 when using a post process search.

There is a workaround mentioned by @gjanders in a Splunk Ideas comment about this issue involving the use of the loadjob command.
https://ideas.splunk.com/ideas/EID-I-1937

Here is the comment:

Consider this example for a base/post-process search:

<search id="basesearch">
  <query>| makeresults count=1 | streamstats count</query>
  <done>
    <set token="sid">$job.sid$</set>
  </done>
</search>
<row>
  <panel>
    <title>loadjob of basesearch</title>
    <table>
      <title>Can export</title>
      <search>
        <query>| loadjob $sid$</query>
      </search>
      <option name="drilldown">none</option>
    </table>
  </panel>
</row>

That should do what you expect, note that the loadjob isn't technically the same as a post-process search but you can use to achieve the same goal...
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...