Dashboards & Visualizations

Is it possible to make an app that can save information to an index that is input by a user?

fd26645
Path Finder

I made a dashboard that reports on backup success/failure.

Users are requesting the ability to add comments to the results or add a checkbox or something that indicates if a failure has been resolved.

To the best of my knowledge Splunk doesn't have the ability to write to the index after the fact. The data always stays in its original format once it has been indexed. So I need some suggestions on how to go about doing this. I would have to link the results of a search to an external database of some kind. I was thinking if I could somehow cause the dashboard interface to generate events that I would collect in another index and then correlate that to the original search results, that might work.

Any suggestions?

0 Karma
1 Solution

stephanefotso
Motivator

yes it is possible. With the collect command, you can ubdate your index.
Let suppose that you have an index called myindex which has certain events, with two fields ( field1, field2). And then you want your users to update myindex (add new events), with a custom field. Let say comments field. Here you go:

  1. You have a text box where a user can enter a comment.
  2. After a user entered his comment, you can update myindex by simply execute a query like this:

    index=myindex ....... |eval comments="$your_textbox_token$"|table field1 field2 comments|collect index=myindex marker="report=\"report1\"
    myindex will now has new events, with users comments, and you could be able to report on it.
    eg: index=myindex report="report1"|table field1 field2 comments

Thanks!
Stephane

SGF

View solution in original post

stephanefotso
Motivator

yes it is possible. With the collect command, you can ubdate your index.
Let suppose that you have an index called myindex which has certain events, with two fields ( field1, field2). And then you want your users to update myindex (add new events), with a custom field. Let say comments field. Here you go:

  1. You have a text box where a user can enter a comment.
  2. After a user entered his comment, you can update myindex by simply execute a query like this:

    index=myindex ....... |eval comments="$your_textbox_token$"|table field1 field2 comments|collect index=myindex marker="report=\"report1\"
    myindex will now has new events, with users comments, and you could be able to report on it.
    eg: index=myindex report="report1"|table field1 field2 comments

Thanks!
Stephane

SGF

fd26645
Path Finder

That is great! Thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...