Reporting

In 4.3, the Advanced Charting view generates a 0 byte file when you try to Export Unlimited.

jbsplunk
Splunk Employee
Splunk Employee

Under 4.3, you have the ability to export either Unlimited or 10000 results. Looks like in the Advanced Charting view, unlimited does not work at all for any of the 3 formats: CSV, XML or JSON. Has anyone else seen this behavior?

Tags (1)
1 Solution

Ellen
Splunk Employee
Splunk Employee

In 4.3 through 4.3.2 this is a known issue, SPL-51334.

The temporary workaround is to make the simple modification in the charting view's xml as below.

Note: a restart is not necessary and the number of results returned is not a factor

Modify the charting view's xml via:
Manager > User Interface > Views > charting

Replace the text "event" to "result" in the following line and Save:
From:

<module name="Export"><param name="exportType">event</param></module>

To:

<module name="Export"><param name="exportType">result</param></module>

View solution in original post

sideview
SplunkTrust
SplunkTrust

For me it's broken whether or not you pick unlimited or whether you set a limit. The problem seems to arise when the search is anything other than a trivial "events" search. IE if you have any stats commands in there, or any transforming/reporting commands, the export will generate only an empty csv.

0 Karma

Ellen
Splunk Employee
Splunk Employee

In 4.3 through 4.3.2 this is a known issue, SPL-51334.

The temporary workaround is to make the simple modification in the charting view's xml as below.

Note: a restart is not necessary and the number of results returned is not a factor

Modify the charting view's xml via:
Manager > User Interface > Views > charting

Replace the text "event" to "result" in the following line and Save:
From:

<module name="Export"><param name="exportType">event</param></module>

To:

<module name="Export"><param name="exportType">result</param></module>
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...