I have a large number of reports to produce according to a data hierarchy. These are to be provided to the client as PDFs. Currently I have some of these representing the top level of the hierarchy written as dashboards, as there are multiple searches within each dashboard. However, I need to bulk produce these PDFs across the data hierarchy. Here's some example usage:
I need to produce a PDF containing several searches for each of the three countries: England, Scotland, Wales (the searches need this country as a parameter)
I need to produce a PDF containing several searches for each of the counties within that country (i.e one PDF per combination of country and county). The searches will need the country and county as parameters.
I need to produce a PDF containing several searches for each of the towns within that combination of country and county (i.e. one PDF per combination of country, county and town). The searches will need the country, county, and town as parameters.
They are to be emailed out as it is not practical to grant access to the dashboards themselves.
I'm not sure how familiar you are with writing custom scripts, but you should be able to complete this using the Splunk Rest API. Give the command here a try: https://answers.splunk.com/answers/223655/can-i-export-pdf-via-rest.html
@bruceclarke: Thanks for this Bruce. That looks a good fit. Is it possible to include the parameters required by the individual dashboards (country, county, town, etc) as parameters to the REST API call?
Good point. The Splunk Rest API only supports static dashboards, so no form inputs. If you want to input parameters, you need to have a static XML for each input.
In my case, what I do is have a template XML file and the list of inputs for which I want to generate a PDF. In my script, I replace any placeholders in the template with an input from the list (so now I have a static XML dashboard), generate the PDF for that input, and then move to the next input.
@bruceclarke: Thanks Bruce - I'll go with that.