Splunk Fixing Export Into Something We Can Work With

[dcsteve24]

In summary, we are trying to generate a fully automated report generator (dynamic reports) via the data we ingested that we can just print and send to customers. I know this isnt really what Splunk is intended for, but we've managed to get really close with HTML thrown between tables and such.

Some things that would inherently help (in case a Splunk developer sees this):

- Have a supported "header/footer" on tables and visualizations. Allow them to be left, center, right aligned as desired. This allows us to add proper classifications to the tables inheritly. Right now we work around this with HTML.

- HTML Page Break Support. I'm having to add a bunch of html blocks with breaks in them. If I do in one block it tries to auto position it together, so separating it allows it to break apart better. Personally I like this feature because I can keep text together that I need to.

- .Doc or .Docx export support. If we could easily edit the output then most this isn't a huge problem.

Anyways, onto the problem:
I have a dashboard developed with everything I need. Problem is, getting it into a artifact. I have toyed with every export I can find and each one has different issues. They are order with the most effective at the bottom and their issues:
- Browser --> Print --> PDF: Doesn't format right at all. Grabs all text seen as expected (menus, buttons, etc). Threw this option out quickly.

- Splunkbase Smart Export App --> Works really well in capture and expectations. It keeps formatting and colors, etc. However, it prints based on pane. Meaning you have to separate apps into separate panes manually to get alignment right. If the pane is bigger than the page, it doesn't roll to the next page; it cuts it off there. So I moved away from this because some tables may be larger than a single page. Additionally, it doesn't support third party apps, leaving a blank page (to include a blank page for itself lol). No page header/footer.

- Export --> PDF: Adds a bunch of unexplainable spacing between some tables and the next HTML block. Haven't found a link into why. My align right HTML doesn't align right, making the table classifications wrong. Doesn't support third party applications but formats all around it correctly, allowing us to still add it manually on top with little added work. No page header/footers. Manual page breaks. This is one of the better ones. Just don't know how to fix the major problems.

- Export --> Print --> PDF: This is the closest one I can get. It keeps third party apps, I can add page classifications through the print support, and it keeps the HTML formatting! I still have to manual page break as I do with almost all of them. I literally have a workable product from this one but the boss doesn't like the table formats it does. But after messing with HTML and overwriting the default CSS settings of the tables I can format it in a acceptable form the dashboard (cant figure out the column grid lines yet). But the Splunk print export appears to do its own thing with the tables; it ditches the coloring and auto-sizes columns (usually in a bad way). Ironically, the cell coloring through Splunk table formats stays if I use it...

So basically, does anyone know how to fix any of the issues listed. I'm really close with the print job but am open to any of them if people have fixes for those as well.

[richgalloway]

Submit your suggestions to Splunk developers at https://ideas.splunk.com