topic Re: Splunk Dashboard in All Apps and Add-ons

Splunk Dashboard

garimayadav — Wed, 11 Mar 2015 07:15:36 GMT

Can we create a Splunk dashboard where in result of search query can be post-processed programmatically?

Re: Splunk Dashboard

satishsdange — Wed, 11 Mar 2015 07:30:59 GMT

Could you please give a use cases/example that explains your query in detail.

Re: Splunk Dashboard

garimayadav — Wed, 11 Mar 2015 08:15:27 GMT

We want to create a customised dashboard where in user enters some id and result is displayed in a table below on the same screen. Now, I have following questions:

1) Can we create a text box on dashboard which takes input and then at the backend, we utilize this input ( say "id") to create a search query?
2) Can we use Splunk Java SDK at the back end for writing business logic?
2) Once search query is created using SPlunk Java SDK, we would process the result of query ( apply some business logic) , and then return the processed result back to the UI ( dashboard). Is this feasible?

Re: Splunk Dashboard

satishsdange — Wed, 11 Mar 2015 08:36:39 GMT

You can certainly create a form in a dashboard that allows users to provide inputs e.g id, username, email id, time range etc. This can be done in core Splunk. Please refer to below doc link http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/FormEditor I don't have answer for 2nd & 3rd question. But you can definitely refer to http://dev.splunk.com/java for more information.

Re: Splunk Dashboard

markthompson — Wed, 11 Mar 2015 10:24:58 GMT

I believe you are able to set variables with an SDK. http://dev.splunk.com/view/java-sdk/SP-CAAAEPZ

Re: Splunk Dashboard

somesoni2 — Wed, 11 Mar 2015 20:42:41 GMT

You should be able to use the textbox value added to the Splunk dashboard/form and generate a dynamic search query, run it and display the result. Feasibility of the dynamic query depend on the requirement. Please post the business rule that you want to apply on the value of the text box, people here may be able to give you appropriate help/pointers.

Re: Splunk Dashboard

slashnburn — Wed, 11 Mar 2015 21:37:00 GMT

This is absolutely feasible. I would recommend downloading the web framework toolkit to get some background on search managers and the like.

Essentially you will create a search manager for each of your various forms, perform your business logic on myresults.data, then return it back to whatever splunk view you want.

Another good starting point for some background can be found here http://dev.splunk.com/webframework

I should note that you will need access to the server's file system.