Maybe for someone will be useful:[ How export to csv only 2 rows from base query] #Workaround Export with Base Search, Post Processing. 1. IN Your dashboard xml <search id="BASE_SEARCH_EXAMPLE"> <query> index=_internal sourcetype=* | fields * </query> 2. Post Procesing query stats base on base search, show only 2 rows. <Base Search> | stats count by source | head 2 <table> <title>Post Processing table with 2 rows for export</title> <search base="BASE_SEARCH_EXAMPLE"> <done> <set token="start_query_inputlookup">| inputlookup FileForExport.csv</set> </done> <query>| stats count by source | head 2 | outputlookup FileForExport.csv</query> </search> <option name="drilldown">none</option> </table> 3. Hide table with query "| inputlookup FileForExport.csv" and job.sid required for export token $job_exportTocsv$. <panel depends="$nevershow$"> <table> <title>Hide table with import query, job.sid required for export.</title> <search> <done> <set token="job_exportTocsv">$job.sid$</set> </done> <query>$start_query_inputlookup$</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> <refreshType>delay</refreshType> </search> </table> </panel> 4. Button or link required for download csv file, paste someware in dashboard. <table> </table> <html> <a target="_blank" class="btn" href="/api/search/jobs/$job_exportTocsv$/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=FileForExportDetails.csv&outputMode=csv" role="button">Export_Data_csv</a> </html> </panel>
... View more
