Reporting

In 4.3, the Advanced Charting view generates a 0 byte file when you try to Export Unlimited.

jbsplunk
Splunk Employee
Splunk Employee

Under 4.3, you have the ability to export either Unlimited or 10000 results. Looks like in the Advanced Charting view, unlimited does not work at all for any of the 3 formats: CSV, XML or JSON. Has anyone else seen this behavior?

Tags (1)
1 Solution

Ellen
Splunk Employee
Splunk Employee

In 4.3 through 4.3.2 this is a known issue, SPL-51334.

The temporary workaround is to make the simple modification in the charting view's xml as below.

Note: a restart is not necessary and the number of results returned is not a factor

Modify the charting view's xml via:
Manager > User Interface > Views > charting

Replace the text "event" to "result" in the following line and Save:
From:

<module name="Export"><param name="exportType">event</param></module>

To:

<module name="Export"><param name="exportType">result</param></module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

For me it's broken whether or not you pick unlimited or whether you set a limit. The problem seems to arise when the search is anything other than a trivial "events" search. IE if you have any stats commands in there, or any transforming/reporting commands, the export will generate only an empty csv.

0 Karma

Ellen
Splunk Employee
Splunk Employee

In 4.3 through 4.3.2 this is a known issue, SPL-51334.

The temporary workaround is to make the simple modification in the charting view's xml as below.

Note: a restart is not necessary and the number of results returned is not a factor

Modify the charting view's xml via:
Manager > User Interface > Views > charting

Replace the text "event" to "result" in the following line and Save:
From:

<module name="Export"><param name="exportType">event</param></module>

To:

<module name="Export"><param name="exportType">result</param></module>
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...