Download and schedule email exports of dashboard content for sharing

Download or schedule an email export of a dashboard to analyze, save, and share with other people. For example, you might want to download a dashboard for flexibility and accessibility of data in different formats. Download a visualization to add to a presentation. Or, schedule an email export of a dashboard to automate the distribution of dashboards.

Download a dashboard or visualization

You can download a dashboard to keep a historical record or share it with colleagues. Another shareable option is exporting a PNG image of a dashboard visualization instead of the whole dashboard.

Download a dashboard

You can download a dashboard as a PDF or PNG in View mode by clicking the Actions dropdown in the menu bar and selecting a format. A dashboard downloaded in either format displays the entire dashboard as one image.

Download a visualization

You can export a PNG image of a visualization in your dashboard for a quick snapshot. Additionally, you can export the data results of any visualization to a CSV for a shareable compact file format.

1. Hover over a visualization until an icon menu appears at the bottom of the visualization. This menu is the visualization's action panel.
2. Select the arrow icon to activate the exporting modal.
3. Give your file an identifying name in the File name field.
4. Select a type from the File type dropdown.
5. Select Export.

Troubleshooting

• Your download does not render or only partially renders.
• Make sure your searches have finished. If you try to download a dashboard while searches are still running, you'll see a confirmation message. If you continue to download the dashboard, it might not render completely.
• Visualizations that depend on real-time searches will result in the same confirmation message as those searches that are still running. These visualizations will render depending on the search results at the time the dashboard is downloaded.
• Visualization panels are empty.
• Any visualizations that depend on data sources that return no data will appear empty.
• Images that come from an external URL will not render. To ensure these images render, save them to a local directory and upload them to your dashboard.

Schedule an email export

You must have the list_settings and schedule_search capabilities to schedule an export with Dashboard Studio. schedule_search is available to all users, but by default, only admins and sc_admins have the list_settings.

Scheduled email exports automate the distribution of dashboards and provide you and your team with regular updates. For example, you might need updates on critical metrics or want to track progress on a project. A scheduled email export also makes data available to team members who might not have immediate access to the dashboard. You can also keep the exports for a documented record and compare them with past results.

1. In View mode, navigate to Actions, and then Schedule export.
2. Select Schedule export to open the Edit export schedule modal.
3. Select the Schedule option.
4. Set the cadence of your export using the Schedule dropdown.
   1. The schedule is set to the timezone of your Splunk instance, which might be different from the client timezone set under a user's preference. You can check the timezone in the success message that appears after you save the scheduled export.
   2. If you select Run by Cron, see Specify a cron schedule.
5. Specify the email details.
   1. Use a comma separated list of email recipients in the Email recipients field. You can also use a defined list of allowed email recipients. For more details about email domains, see Email notification action in the Alerting Manual.
   2. Set the Priority of the email to Critical, High, Normal, Low, or Very Low. Enforcement of priority depends on your email client.
   3. Write the contents for Subject and Message. You can also use tokens in the Subject and Message fields. For more details, see Use tokens with scheduled email exports.
6. (Optional) Select Include link to dashboard to provide a direct link to the dashboard in your Splunk instance. Always use discretion when sharing dashboard links with any email recipient.
   1. Links are unavailable for test emails.
7. (Optional) Select Send test email to immediately send a preview of the email contents to all recipients in the Email recipients field.
8. Select Save to save the scheduled email export settings.

Best practices for scheduling an email export

The following lists ways to optimize schedules for your email exports:

• Schedule exports during low traffic times, such as evenings or weekends
• Stagger schedules to prevent searches from running at the same time
• Limit the number of scheduled exports to 5 per minute

Cancel a scheduled email export

1. For the dashboard that you want to discontinue PDF delivery, select Actions, and then Schedule export.
2. Deselect the Schedule option.
3. Select Save to save the schedule delivery settings.

Use tokens with scheduled email exports

Tokens represent data generated by a search. Use tokens as placeholders or variables for data values that populate when the search completes.

Scheduled email export supports the following types of tokens:

• Search metadata
• Server information
• Dashboard information

Access the value of a token with the following syntax:

$<token-name>$

For example, place the following token in the subject field of a scheduled PDF delivery to reference the app containing the dashboard.

Search results from $app$

For more about email tokens, see Use tokens in email notifications in the Alerting Manual.

Specify a cron schedule

You can use cron notation to define a custom delivery schedule. Select the Cron option to input a schedule. When specifying a cron expression, only 5 cron parameters are available, not 6. The 6th parameter for year, common in other forms of cron notation, is not available.

Here are some example cron expressions.

*/5 * * * *       Every 5 minutes.
*/30 * * * *      Every 30 minutes.
0 */12 * * *      Every 12 hours, on the hour.
*/20  * * * 1-5   Every 20 minutes, Monday through Friday.
0 9 1-7 * 1       First Monday of each month, at 9am.

For more information about cron scheduling, see Use cron expressions for alert scheduling in the Alerting Manual.

External URL images in the scheduled email export

All external URL images must be in the Dashboards Trusted Domains List. Images not in the list will not render and are replaced with an "Image not found" placeholder image.

For more Splunk Cloud Platform related details, see Configure Dashboards Trusted Domains List in the Splunk Cloud Platform Admin Manual.

For Splunk Enterprise details, see Configure Dashboards Trusted Domains List in the Splunk Enterprise Admin Manual.

Limitations for Dashboard Studio scheduled email exports

The following lists the limitations of scheduling email exports of Dashboard Studio dashboards:

• Scheduled email exports of dashboards are only available on Windows or Linux.
• Scheduled email exports of dashboards only render Latin based alphabets and locals, such as English, French, and Spanish.
• Scheduled email exports render fonts differently depending on your operating system. You can workaround this limitation by creating the dashboard with the same operating system as your Splunk instance.
• Scheduled email exports render only the table rows showing in the dashboard and not rows that become visible with pagination.
• Scheduled email exports render dashboards based on the canvas width and height. To change the email export layout to landscape or portrait, modify the canvas width and height.
• Scheduled email exports don't support logos. You can workaround this limitation by adding an image of the logo to the dashboard.
• Scheduled email exports don't support headers or footers. You can workaround this limitation with Markdown. For more details, see Add text, links, and images with Markdown.
• Scheduled email exports use token default values to render content. If there is no default token value, the token will not set.
• Scheduled email exports of PNGs inlined in the email body might not render due to email client security settings.
• Scheduled email exports in a Gmail spam folder must be moved to the general inbox for full rendering of images inlined in the email body.
• Scheduled email exports don't support visualizations using the trellis layout.

Modify concurrent and timeout settings for exports

You can configure the concurrency or timeout settings for your scheduled email exports to help improve performance and manage resource usage.

Modify concurrency limits

To optimize performance, schedule a maximum of 5 dashboard exports per minute. To enforce a concurrency limit, Splunk Enterprise users can set a maxConcurrent setting on the pdfgen/render stanza in restmap.conf. Splunk Cloud Platform users can reach out to Splunk support to update their maxConcurrent setting.

Modify the timeout setting for rendering the dashboard

Adjusting the timeout period impacts Chromium's timeout for rendering a dashboard after all searches have been completed, not the entire end to end process. The default for a Chromium timeout is 30 seconds. Changing the timeout period does not require a restart of your Splunk instance. For more details about using REST API endpoints as a Splunk Cloud Platform user, see Access requirements and limitations for the Splunk Cloud Platform REST API in the REST API Tutorials.

The following steps show how you can adjust the time it takes to render a dashboard and take a screenshot:

1. Write your initial REST command. The command uses the following structure: https://<host>:/servicesNS/<user>/<app_name>/properties/limits/pdf. For example, your REST command might look like the following:

   curl --location -u <admin_username>:<password> --request POST 'https://<host>/servicesNS/nobody/system/properties/limits/pdf' \
   

2. Write your header request parameter. For example, your header request parameter might look like the following:

   --header 'Content-Type: application/x-www-form-urlencoded' \
   

3. Write the render_chromium_timeout data request parameter with the number of seconds you want it to take for Chromium to render the dashboard and take a screenshot. For example, your request parameter might look like the following:

   --data-urlencode 'render_chromium_timeout=60'
   

Modify the number of pdfgen requests

Only alter the number of requests if resource usage becomes an issue. Changing the number of pdfgen requests impacts the entire end to end dashboard process, including searches. For more details about using REST API endpoints as a Splunk Cloud Platform user, see Access requirements and limitations for the Splunk Cloud Platform REST API in the REST API Tutorials.

The following steps show how you can change how many pdfgen requests run simultaneously:

1. Write your initial REST command. The command uses the following structure: https://<host>:/servicesNS/<user>/<app_name>/properties/limits/pdf. For example, your REST command might look like the following:

   curl --location -u <admin_username>:<password> --request POST 'https://<host>/servicesNS/nobody/system/properties/restmap/script:pdfgenHandler' \
   

2. Write your header request parameter. For example, your header request parameter might look like the following:

   --header 'Content-Type: application/x-www-form-urlencoded' \
   

3. Write the maxConcurrent data request parameter with the number of dashboard email exports you want scheduled per minute. For example, your request parameter might look like the following:

   --data-urlencode 'maxConcurrent=5'
   

4. Restart your Splunk instance to update your changes.

Modify the timeout setting for the entire export process

This setting configures PDF generation timeout settings for all PDFs in your Splunk deployment.

Changing the PDF generation timeout setting impacts the whole end to end dashboard process, including searches. The default timeout for generating a PDF is 60 minutes, as specified in limits.conf. A complex search that is slow to complete might need additional time to create the PDF.

To configure the timeout for generating a PDF:

1. Open $SPLUNK_HOME/etc/system/local/limits.conf for editing. Create this file if it does not already exist.
2. Specify the number of seconds to wait to generate a PDF. This property is in the [pdf] stanza:

   [pdf]
   render_endpoint_timeout = <integer>
   

Export a dashboard as a PDF or PNG using REST API endpoints

You can export a dashboard in PDF or PNG format using the pdfgen/render API. The API generates a PDF by default. To generate a PNG, when writing your REST command, set the type query parameter to png. For example, your REST command might look like the following:

curl -u <username>:<password> --location --request POST 'https://<api_host>:<api_port>/services/pdfgen/render?type=png&input-dashboard=<dashboard_id>&namespace=<namespace>'

The <namespace> parameter is the name of your app.

Send an email with an exported dashboard using REST API endpoints

You can email an exported dashboard using a REST API endpoint with the following elements:

• search/jobs API endpoint
• sendemail search command
• sendpdf=true or sendpng=true parameter
• pdfview=<dashboard_id> parameter
• <namespace> parameter
  • The <namespace> parameter is the name of your app.

For example, your REST command might look like the following:

curl -k -u <username>:<password> https://<api_host>:<api_port>/servicesNS/<username>/<namespace>/search/jobs --data-urlencode search='search | sendemail use_ssl=false use_tls=false to="<email>" cc="" bcc="" priority=3 sendpdf=true sendpng=false inline=0 from="splunk" subject="Here is an email from Splunk" message="This is an example message" pdfview="<dashboard_id>" sendtestemail="1"'

The inline parameter applies only to PNGs. inline=1 or inline=true sets the PNG in the email body, and PNGs are also always attached to the email.

The inline parameter does not impact PDFs, which are always attached to the email.

Send an email with an exported dashboard using Search

To send an exported dashboard as an email, use the sendemail search command as part of a search and attach a PDF or PNG export of the dashboard.

For example, your search might look like the following:

| sendemail use_ssl=false use_tls=false to="<email>" cc="" bcc="" priority=3 sendpdf=true sendpng=false inline=0 from="splunk" subject="Here is an email from Splunk" message="This is an example message" pdfview="<dashboard_id>" sendtestemail="1"

For more details, see sendemail in the Search Reference manual.