Re: How to add download button while hiding the re...

Splunkerninja

I want to add a download/export button which I am able to do so but the issue is the result of the csv is also visible in the panel like below. I want to show only the download button while hiding the results panel which I am not able to do.

<row>
<panel>
<table>
<search>
<done>
<eval token="date">strftime(now(), "%d-%m-%Y")</eval>

<set token="sid">$job.sid$</set>
</done>
<query>index=test</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>

<html>

<a href="/api/search/jobs/$sid$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=test_$date$.csv&amp;outputMode=csv" class="button js-button">Download</a>
<style>
.button {
background-color: steelblue;
border-radius: 5px;
color: white;
padding: .5em;
text-decoration: none;
}

.button:focus,
.button:hover {
background-color: #2A4E6C;
color: White;
}
</style>
</html>
</panel>
</row>

renjith_nair

@Splunkerninja ,

Can we add another row only for the html panel and hide the result row/panel with a "depends" token?

Something like

<row>
<panel depends="$hide_this_always$">
<table>
<search>
<done>
<eval token="date">strftime(now(), "%d-%m-%Y")</eval>

<set token="sid">$job.sid$</set>
</done>
<query>index=test</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<html>

<a href="/api/search/jobs/$sid$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=test_$date$.csv&amp;outputMode=csv" class="button js-button">Download</a>
<style>
.button {
background-color: steelblue;
border-radius: 5px;
color: white;
padding: .5em;
text-decoration: none;
}

.button:focus,
.button:hover {
background-color: #2A4E6C;
color: White;
}
</style>
</html>

</row>

---
What goes around comes around. If it helps, hit it with Karma 🙂

Splunkerninja

I get this error if i add in different row as you mentioned above

@ITWhisperer Any suggestions pls?

renjith_nair

@Splunkerninja, this is clearly not due to the row separation but the formation of the URL for getting the search results.

So if the current dashboard is working for you with the search result URL, just make the first change by closing the </row> after the table panel and open another <row> element before the html element. This will ensure that the existing dashboard is working as expected.

As a second step, change the visibility of the row where table is listed and set a "depends" clause with non existing token.

---
What goes around comes around. If it helps, hit it with Karma 🙂

Splunkerninja

@renjith_nair Thank You for the response. I keep getting check "network internet connection" when I click on download button and it is failing to download. I was able to download the report once but later I keep getting this error? I know for a fact it is not internet issue because I able to download the other panels data directly when i click the default export button which is there in Splunk. Is it something related to my code?

 <row depends="$hide_this_always$">
    <panel>
      <table>
        <search>
          <done>
            <eval token="date">strftime(now(), "%d-%m-%Y")</eval>
            <set token="sid">$job.sid$</set>
          </done>
          <query>index=_internal</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
<row>
    <panel>
      <html>

<a href="/api/search/jobs/$sid$/results?isDownload=true&amp;maxLines=0&amp;count=0&amp;filename=Vulnerability_$date$.csv&amp;outputMode=csv" class="button js-button">Download</a>
<style>
.button {
background-color: steelblue;
border-radius: 5px;
color: white;
padding: .5em;
text-decoration: none;
}

.button:focus,
.button:hover {
background-color: #2A4E6C;
color: White;
}
</style>
</html>
    </panel>
  </row>

renjith_nair

Ok, lets check if the results are available by just removing below from the dashboard

depends="$hide_this_always$"

We need to confirm the sid is available since its part of the download path. So either in the title of the panel or somewhere just display the token.

If the result is available and sid is present, try using the URL directly in the browser to make sure that the result is fetched.

Here is a sample dashboard created using the same logic and it works

<dashboard version="1.1" theme="light">
  <label>Download</label>
  <row>
    <!-- Below is the table with the results. We are setting the panel depends to a non existing token so that it always false the panel is not visible.-->
    <panel depends="$hide_always$">
      <title>$sid$</title>
      <table>
        <search>
          <query>index=_*|stats count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <done>
            <eval token="date">strftime(now(), "%d-%m-%Y %H:%M:%S")</eval>
            <set token="sid">$job.sid$</set>
          </done>          
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <!-- Setting the title for testing purpose and making sure that the SID is available in the token -->
      <title>Job Id is : $sid$, Time is : $date$</title>
      <html>

<a href="/api/search/jobs/$sid$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=test_$date$.csv&amp;outputMode=csv" class="button js-button">Download</a>
<style>
.button {
background-color: steelblue;
border-radius: 5px;
color: white;
padding: .5em;
text-decoration: none;
}

.button:focus,
.button:hover {
background-color: #2A4E6C;
color: White;
}
</style>
</html>
    </panel>
  </row>
</dashboard>

---
What goes around comes around. If it helps, hit it with Karma 🙂

Splunkerninja

@ITWhisperer++++ Any suggestions pls?

ITWhisperer

Rest assured, if I had any suggestions, I would have given them by now.

How to add download button while hiding the result s of the panel

configuration

Splunk Investigate

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases