Splunk Search

Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK?

Explorer

I have a large number of reports to produce according to a data hierarchy. These are to be provided to the client as PDFs. Currently I have some of these representing the top level of the hierarchy written as dashboards, as there are multiple searches within each dashboard. However, I need to bulk produce these PDFs across the data hierarchy. Here's some example usage:

I need to produce a PDF containing several searches for each of the three countries: England, Scotland, Wales (the searches need this country as a parameter)
I need to produce a PDF containing several searches for each of the counties within that country (i.e one PDF per combination of country and county). The searches will need the country and county as parameters.
I need to produce a PDF containing several searches for each of the towns within that combination of country and county (i.e. one PDF per combination of country, county and town). The searches will need the country, county, and town as parameters.

They are to be emailed out as it is not practical to grant access to the dashboards themselves.

1 Solution

Contributor

Hey @Redman11,

I'm not sure how familiar you are with writing custom scripts, but you should be able to complete this using the Splunk Rest API. Give the command here a try: https://answers.splunk.com/answers/223655/can-i-export-pdf-via-rest.html

View solution in original post

Contributor

Hey @Redman11,

I'm not sure how familiar you are with writing custom scripts, but you should be able to complete this using the Splunk Rest API. Give the command here a try: https://answers.splunk.com/answers/223655/can-i-export-pdf-via-rest.html

View solution in original post

Explorer

@bruceclarke: Thanks for this Bruce. That looks a good fit. Is it possible to include the parameters required by the individual dashboards (country, county, town, etc) as parameters to the REST API call?

0 Karma

Contributor

Good point. The Splunk Rest API only supports static dashboards, so no form inputs. If you want to input parameters, you need to have a static XML for each input.

In my case, what I do is have a template XML file and the list of inputs for which I want to generate a PDF. In my script, I replace any placeholders in the template with an input from the list (so now I have a static XML dashboard), generate the PDF for that input, and then move to the next input.

0 Karma

Explorer

@bruceclarke: Thanks Bruce - I'll go with that.

0 Karma