All Apps and Add-ons

Trigger outputcsv, popup prompt, and powershell script from dashboard button

redc
Builder

I need a button on a dashboard that does three things:

  1. Appends the dashboard's search with additional search activities (spec.: " | fields ReaderUserKey | outputcsv mycompany_WS_leads.csv") in order to dump a single field from the search (ReaderUserKey) to a CSV file under $SPLUNK_HOME$\var\run\splunk\
  2. Open a popup prompt to accept the Splunk user's email address
  3. Fire a powershell script, sending it the CSV filename (from #1) and the email address (from #2)

I've successfully gotten the button to do #1.

I'm able to get the JS "alert" style popup to come up (related to #2), but this is too basic - I'd actually like to be able to pop up something like the "Save as Report" popup that you get off the flashtimeline view, where you enter some criteria and hit the "Save" button and it goes off and does its thing. It looks like the popup is just a special view of some sort, but I'm not sure how to get it to display as a popup in a custom form.

I'm not sure how to tackle #3. I'm trying to figure out how to implement this solution: http://answers.splunk.com/answers/115237/add-button-to-view-to-call-script

CURRENT PROBLEMS:

  1. The JS popup is too basic for our needs
  2. Not sure how to get it to fire the powershell script (I think I want to use the "Redirector" module, but I'm not sure if that's the best way to do it - and I haven't gotten it to work yet)

Code:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html" stylesheet="application.css" script="application.js">
  <label>Leads</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="maxSize">1</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="filter">*</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="maxSize">1</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="filter">splunk.search.job</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <!-- Start Time Range Dropdown -->
    <module name="Pulldown" layoutPanel="panel_row1_col1">
      <param name="name">customRange</param>
      <param name="label">Time Range: </param>
      <param name="staticOptions">
        <list>
          <param name="label">Last 7 days</param>
          <param name="value">-7d@d,@d,7d</param>
        </list>
        <list>
          <param name="label">Last 30 days</param>
          <param name="value">-30d@d,@d,30d</param>
        </list>
      </param>
      <module name="ValueSetter">
        <param name="name">multiValueTimeRange</param>
        <param name="delim">,</param>
        <param name="value">$customRange$</param>
        <!-- End Time Range Dropdown -->

        <!-- Start Saved Search Loaders -->
        <module name="Search" layoutPanel="panel_row5_col1">
          <param name="search"><![CDATA[| loadjob savedsearch="admin:mycompany:WS_Leads_$multiValueTimeRange[2]$"]]></param>
          <module name="Gate">
            <param name="to">leadsGate</param>
          </module>
        </module>

        <!-- Start Drop-down Panels -->
        <!-- Start Product Dropdown -->
        <module name="Search" layoutPanel="panel_row1_col1">
          <param name="search"><![CDATA[| loadjob savedsearch="admin:mycompany:WS_Sales_$multiValueTimeRange[2]$" ]]></param>
          <module name="Pulldown">
            <param name="name">selectedProdDesc</param>
            <param name="label">Leads</param>
            <param name="size">4</param>
            <param name="template">ProdID="$value$"</param>
            <param name="separator">+OR+</param>
            <param name="outerTemplate">( $value$ )</param>
            <param name="staticFieldsToDisplay">
              <list>
                <param name="label">Any</param>
                <param name="value">*</param>
              </list>
            </param>
            <param name="searchFieldsToDisplay">
              <list>
                <param name="label">Product</param>
                <param name="value">ProdID</param>
              </list>
            </param>

            <!-- End Product Dropdown -->

            <module name="HTML" layoutPanel="panel_row2_col1">
              <param name="html">
                <![CDATA[<div class="splHeader splHeader-dashboard"><h2 title="Includes" s:group="Includes">Inclusion Parameters</h2></div>]]>
              </param>
              <!-- Start Custom Fields Dropdowns -->
              <!-- Start Job Title Dropdown -->
              <module name="Search">
                <param name="search"><![CDATA[| inputlookup WSCF.csv | search CustomField="olWSTitleCF"]]></param>
                <module name="Pulldown" layoutPanel="panel_row2_col1">
                  <param name="name">selectedJobTitle</param>
                  <param name="label">Job Title</param>
                  <param name="size">4</param>
                  <param name="template">WSTitleCF="$value$"</param>
                  <param name="separator">+OR+</param>
                  <param name="outerTemplate">( $value$ )</param>
                  <param name="staticFieldsToDisplay">
                    <list>
                      <param name="label">Any</param>
                      <param name="value">*</param>
                    </list>
                  </param>
                  <param name="searchFieldsToDisplay">
                    <list>
                      <param name="label">ValueDesc</param>
                      <param name="value">ValueDesc</param>
                    </list>
                  </param>
                  <!-- End Job Title Dropdown -->

                  <!-- Start Refresh Results Button -->
                  <module name="Button" layoutPanel="panel_row4_col1">
                    <param name="label">Refresh Results</param>
                    <param name="allowSoftSubmit">False</param>
                    <param name="allowAutoSubmit">False</param>
                    <!-- End Refresh Results Button -->
                    <module name="Button" LayoutPanel="panel_row4_col1">
                      <param name="label">Save to Email List</param>
                      <param name="allowAutoSubmit">False</param>
                      <param name="customBehavior">confirmationPopup</param>
                      <module name="Search">
                        <param name="search">
                          <![CDATA[| loadjob savedsearch="admin:mycompany:WS_Leads_$multiValueTimeRange[2]$" | 
search $selectedJobTitle$ $selectedProdDesc$ | fields ReaderUserKey | outputcsv mycompany_WS_Leads.csv]]>
                        </param>
                        <module name="CustomBehavior">
                          <param name="requiresDispatch">True</param>
                        </module>
                      </module>
                    </module>

                    <!-- Start Searches for ad-hoc loads -->
                    <!-- leadsGate search -->
                    <module name="Search">
                      <param name="search">
                        <![CDATA[
| loadjob savedsearch="admin:mycompany:WS_Leads_$multiValueTimeRange[2]$" | 
search $selectedJobTitle$ $selectedProdDesc$
]]>

                      </param>
                      <module name="Gate">
                        <param name="to">leadsGate</param>
                      </module>
                      <module name="SearchControls" layoutPanel="panel_row4_col1">
                        <param name="sections">export</param>
                      </module>
                    </module>
                    <!-- End pageGate search -->
                    <!-- End Searches for ad-hoc loads -->
                  </module><!--Refresh Button-->
                </module><!--Job Title Pulldown-->
              </module><!--Job Title Search-->
            </module><!--Inclusion HTML panel-->
          </module><!--Product Pulldown-->
        </module><!--Product SavedSearch-->
      </module><!--Time Valuesetter-->
    </module><!--Time Pulldown-->
  </module><!--URLLoader-->

  <!-- First Results Panel -->
  <!-- Start First Results Panel -->
  <module name="Gate" layoutPanel="panel_row5_col1">
    <param name="id">leadsGate</param>
    <module name="Pager" group="Lead Report">
      <param name="count">120</param>
      <module name="EnablePreview">
        <param name="display">False</param>
        <param name="enable">True</param>
      </module>
      <module name="Table" />
      <module name="JobProgressIndicator"/>
    </module>
  </module>
</view>
0 Karma

sideview
SplunkTrust
SplunkTrust

Prerequisites: you are comfortable in JS and also in Python. You are willing to spend some painful hours reverse engineering and tinkering with funky JS, and debugging and troubleshooting a custom controller in python.

step 1) Write a custom controller to do what you want. ie fork out to
powershell. You might want to restrict it to certain roles only like the admin role, if so look into custom "capabilities" and integrate a check for a custom capability into your custom controller. http://docs.splunk.com/Documentation/Splunk/6.0.1/admin/Authorizeconf

Step 2) Assuming you don't want to roll your own modal popups entirely, study the JS code that runs the modal popups in Splunk.

There is a newer style modal popups there that
have iframes inside, and where the contents of the modal popup is
really a tiny little webpage swapping in and out.

The create dashboard wizard and create alert wizard are examples of this kind.
look at Splunk.Popup.AlertWizard in popup.js

Those little webpages are built using custom controllers and the whole thing follows an MVC model about which you can read more here. http://docs.splunk.com/Documentation/Splunk/6.0.2/Module/Setupyourapp

There is then an older flavor of Splunk modal popups, of which
createSavedSearchForm is an example. it does hit another URL and that
URL kind of builds the form, but the logic and the messaging doesn't follow an MVC model at all and the technical design is both simpler and messier.

Then there is an even older flavor, of which
Splunk.Popup.createExportResultsForm is an example. This is the
oldest kind and it doesn't hit any URL to get the form's contents at
all. It just builds the dang form right in jquery.

Although it's the oldest and least sexy, it's flatter and has fewer moving parts.
I'd consider it here if you are just making a single form with a couple
fields. Make the form post the results post to your custom controller
and make your custom controller just return JSON for
success:true|false and optional message.

sideview
SplunkTrust
SplunkTrust

ok. I would put a Search module and a Pulldown module on the page, up at the top of the xml hierarchy, to render just such a pulldown element with your values and labels in it. Use cssClass param on the Pulldown and some CSS to set visibility:hidden so it's invisible.

Then in your JS, if your cssClass is "hiddenPulldown" you can do

clonedPulldown = $(".hiddenPulldown select").clone()

to grab and clone the Pulldown. Then insert the cloned one into your form's HTML in your popup.

I've left out a lot of details but that's the basic idea and I think that's the shortest way to go.

0 Karma

redc
Builder

Alright, so far, so good. But then we had to go and introduce a new wrinkle...

I need to pass the results of a very simple search into the JavaScript popup as a drop-down, and the results will also then be submitted to the Powershell script:

index="website" | table WebSiteID, URL

Sample results:

mywebsite1 | mywebsite1.server.com
mywebsite2 | mywebsite2.server.com

The value for the drop-down will be the URL value, while the displayed value will be the WebSiteID value. BOTH items need to be submitted to the script.

How can we use the results in the JS popup?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...