All Apps and Add-ons

Is it possible to take a user input in a dashboard?

theouhuios
Motivator

I am not sure if this is really possible at this point of time , but I am here looking for ideas on how to solve an issue which I face on a daily basis.

Lets say I have a dashboard which gives me information about the hosts and sourcetypes for those hosts which aren't sending any data for the past 24 hours. I am using table module to do that. Now if I have 40 hosts having an issue I try to troubleshoot them. What I am trying to add to the dashboard is to be able to keep a note of which server we already troubleshooted. Is it possible to have a text box/or a radio button with 3 options like "solved" "checked" "working" . I am trying to do this so that other team members too can know whats the progress on that server.

Any suggestions would be helpful.

Adding sideview tag as the dashboard is in Sideview.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi theouhuios,

one thing I often use with costumers, are lookup tables containing some additional information like in error, Ops are checking or what ever you want and use this as auto lookup. You also can use the Lookup editor App to edit your lookup on the fly.

hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi theouhuios,

one thing I often use with costumers, are lookup tables containing some additional information like in error, Ops are checking or what ever you want and use this as auto lookup. You also can use the Lookup editor App to edit your lookup on the fly.

hope this helps to get you started ...

cheers, MuS

theouhuios
Motivator

@Mus

I was able to get it working. Thanks for the idea. Now the only concern is that I have to make sure that the lookup is not overwritten.

0 Karma

MuS
SplunkTrust
SplunkTrust

Sorry missed one question: I don't know if you can do this from a dashboard directly, maybe using some fancy js hack? Usually I just open the lookup editor and write stuff in there.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It's certainly possible with a little JS magic in the background. Roughly like this:

  • have some place to click to add a note to this event
  • open dialog to type in note
  • launch a SearchManager that roughly does this | inputlookup notes | append [stats count | eval note="your note goes here" | eval event_id = "the id of the event you clicked" | table event_id note] | outputlookup notes in the background
  • When that search is finished (event "search:done" IIRC) you refresh the main table to include the new note or exclude the host that now has a note or whatever
0 Karma

theouhuios
Motivator

Thanks for the idea martin. I will try it. The issue is I am not good with the JS. 🙂 Will poke around and see if I can do something like this. Will be amazing to be able to do that.

0 Karma

theouhuios
Motivator

Thanks for taking the time MuS. I have some questions though. How would I be able to edit it in the dashboard? Lookup editor edits only that file right? Do I need to place this dashboard in the Lookup App to be able to use that functionality. Sorry about the questions. Kinda confused on how to make it work on the fly for users.

And I need to maintain a lookup file for each host and then integrate it with the dashboard so that a user can change right? this part is simple. I am just confused on how to make the lookup editing part to the user in the dashboard itself.

0 Karma

MuS
SplunkTrust
SplunkTrust

The easiest thing to do, is clone the lookup editor app into a new app and create your dashboards in this new app. Also, setup the auto lookup in this app.
The lookup editor can edit any lookup file the user has permission, I'm not sure if you can limit it only to use lookups in the current app context .....
As I said, create a new app and play around it this app, this way you would only break stuff in this app 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...