Splunk Search

How to save search query in a file in Splunk Dashboard

sambit_kabi
Path Finder

Hi ,

I have a requirement where I want to save the search query after the query has run to a file. Basically i want to have a file with Query name and the query so that users can save and load back their queries in the Dashboard.

Would like to know how can i save a query to a file using outputcsv in the Splunk Dashboard ? How do i get hold of that search query with resolved token values.

Also is there a clean way that Splunk provides to save the dashboard query to a file?

Thanks.

0 Karma

acfecondo75
Path Finder

You could create a scheduled report that runs once a day and configure it to output to a csv (using alert actions) and use a date token in the name of the csv so every day a new csv is generated. Then you would have the dashboard panels reference a lookup. you could have a dropdown selector that dynamically pulls a list of any csvs that have the naming convention used by the report by referencing the rest endpoint for lookups.

The searches that do the inputlookup would use a token in place of the token name so whichever day's lookup the user selected from the dropdown would dynamically populate the dashboard.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.