Description

The Splunk for Excel Export add-on provides a Splunk Web Module and Controller that work together to allow you to export Splunk results to Microsoft Excel Spreadsheets.

Requirements

The Splunk for Excel Export app requires the following:

• Splunk
  • version 4.3 or higher
  • search head running Linux, Windows, or Mac OS X

• Browser
  • latest versions of FireFox, Safari, Chrome, Internet Explorer

Features

ExcelExport module:

• The ExcelExport Module is included with the app that presents a modal dialogue to request an Excel export of up to 1,000,000 events per workbook (65,000 events per sheet)
• After installing Splunk for Excel Export and restarting Splunk, any view in any app should be able to use the module to provide Excel export

Flashtimeline view with integrated Excel export:

• An example view 'flashtimeline_excel' is provided with the app
  • After installing Splunk for Excel Export and restarting Splunk, this view is exported globally and available in all visible apps
  • Example: http://localhost:8000/en-US/app/search/flashtimeline_excel

Excel export controller:

• The excel export controller allows the streaming export of Splunk events or results to Excel spreadsheets, usually via the ExcelExport module

Getting Started

To get started with the Splunk for Excel Export, download the app from Splunkbase and then restart Splunk.

IMPORTANT

• Splunk for Excel Export is an add-on, intended for use in other Splunk apps and views
• Splunk for Excel Export is provided on an as-is basis, and is to be considered a community-supported add-on

Reuse

IMPORTANT

• Do not attempt to integrate individual components of Splunk for Excel Export into your own app or add-on
• Treat Splunk for Excel Export as a dependency for other apps and views that require the ability to export Splunk events or results to Excel

Third-Party Software

• Splunk for Excel Export includes xlwt, which is a python module that facilitates writing to Excel spreadsheets and is distributed under the greater BSD license.

Getting Support

If you have a question about or problem with the app or have a suggestion for a future version, please use the "Ask a question" link rather than asking it in the review section below. The review section should be used to review the app and not to request support.

Known Issues

• Exporting results with more than 256 distinct fields might result in imcomplete results or an error
• When specifying which fields to export using the 'fields' command, '_raw' and '_time' fields will always be implicitly included
  • use the 'chart' command or specify ' | fields -_*' to work around the issue

Changelog

• 1.0
  • initial version

• 1.1
  • SPL-46435 - encoding should be set to "utf-8" in controller excel.py
  • SPL-46513 - support streaming results up to 65535 rows/events
  • SPL-46436 - include example view 'flashtimeline_excel'
  • SPL-46437 - fix 'flashtimeline_excel' CSS based on Splunk version

• 1.1.1
  • SPL-47298 - fix lame indentation error in excel.py

• 1.2
  • SPL-46514 - support export of up to 1 million rows

• 1.3
  • SPL-47761 - move author key under launcher stanza in app.conf to prevent typo message on restart
  • SPL-47333 - update module bgcolor to #EDEDE7 for 4.3 for flashtimeline_excel

• 1.3.1
  • SPL-48074 - spurious comma breaks ExcelExport.js

• 2.0
  • Support for asyncronous operation
  • Improved resilience and performance

• 2.0.1
  • Fixed bug with SSL error handling

Roadmap

• 3.0
  • Improved export and download experience
  • Excel report builder
  • Excel calls to action included in standard views by default