Reporting

In 4.3, the Advanced Charting view generates a 0 byte file when you try to Export Unlimited.

jbsplunk
Splunk Employee
Splunk Employee

Under 4.3, you have the ability to export either Unlimited or 10000 results. Looks like in the Advanced Charting view, unlimited does not work at all for any of the 3 formats: CSV, XML or JSON. Has anyone else seen this behavior?

Tags (1)
1 Solution

Ellen
Splunk Employee
Splunk Employee

In 4.3 through 4.3.2 this is a known issue, SPL-51334.

The temporary workaround is to make the simple modification in the charting view's xml as below.

Note: a restart is not necessary and the number of results returned is not a factor

Modify the charting view's xml via:
Manager > User Interface > Views > charting

Replace the text "event" to "result" in the following line and Save:
From:

<module name="Export"><param name="exportType">event</param></module>

To:

<module name="Export"><param name="exportType">result</param></module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

For me it's broken whether or not you pick unlimited or whether you set a limit. The problem seems to arise when the search is anything other than a trivial "events" search. IE if you have any stats commands in there, or any transforming/reporting commands, the export will generate only an empty csv.

0 Karma

Ellen
Splunk Employee
Splunk Employee

In 4.3 through 4.3.2 this is a known issue, SPL-51334.

The temporary workaround is to make the simple modification in the charting view's xml as below.

Note: a restart is not necessary and the number of results returned is not a factor

Modify the charting view's xml via:
Manager > User Interface > Views > charting

Replace the text "event" to "result" in the following line and Save:
From:

<module name="Export"><param name="exportType">event</param></module>

To:

<module name="Export"><param name="exportType">result</param></module>
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...