How to save search query in a file in Splunk Dashboard

[sambit_kabi]

Hi ,

I have a requirement where I want to save the search query after the query has run to a file. Basically i want to have a file with Query name and the query so that users can save and load back their queries in the Dashboard.

Would like to know how can i save a query to a file using outputcsv in the Splunk Dashboard ? How do i get hold of that search query with resolved token values.

Also is there a clean way that Splunk provides to save the dashboard query to a file?

Thanks.

[acfecondo75]

You could create a scheduled report that runs once a day and configure it to output to a csv (using alert actions) and use a date token in the name of the csv so every day a new csv is generated. Then you would have the dashboard panels reference a lookup. you could have a dropdown selector that dynamically pulls a list of any csvs that have the naming convention used by the report by referencing the rest endpoint for lookups.

The searches that do the inputlookup would use a token in place of the token name so whichever day's lookup the user selected from the dropdown would dynamically populate the dashboard.