topic Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard in Getting Data In

Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

potnuru — Tue, 13 Oct 2020 17:26:53 GMT

Example:

Splunk Dashboard:

Panel 1--->

EMPID NAME TASK COMMENTS

1 SANDEEP A Task A is Completed

2 xyz B B is pending due to so and so reason.

3 yyy C _______________________

I want to build the Dashboard in a way that User should be able to give the COMMENTS for the selected row in Panel 1.

Then Next Time User runs the same Dashboard, User can see the already given comments corresponding to the row. Example 1 and 2 are already having comments. 3 is new row.

User should able to update the comments for 3 by clicking on the row.

is there any way to do it?

Re: Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

potnuru — Thu, 15 Oct 2020 08:00:41 GMT

@rbal_splunk @kaurinko @thambisetty @nick405060

Hi Guys, Please help me on this.

Re: Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

kaurinko — Thu, 15 Oct 2020 13:51:09 GMT

Hi,

Thanks for asking. Your problem looks interesting. Unfortunately I have never worked with anything like that, but on a rainy day I might experiment with some ideas. Right now I can't contribute, sorry.

Re: Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

somesoni2 — Thu, 15 Oct 2020 13:58:46 GMT

You can't edit the data ingested in Splunk, so you can't add additional field and save it to your raw data.

What you might have to do would be to create a lookup table (preferably KV Store as it allows you to update one row) from your data and then run a query to save the lookup data with a new field "COMMENT" which gets it's value from a text box. As you can see it won't be an easy solution to develop. (You'll have to create a lookup with all key fields from your search result and field COMMENT. Then update your current panel search to show the field COMMENT using lookup command. Then create an in-page drilldown for selected rows and show a text box in that drill-down panel, and some way to run an outputlookup search to update the COMMENT field for that set of key fields in your KVSTore lookup).

Re: Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

potnuru — Thu, 15 Oct 2020 16:52:50 GMT

Hi @somesoni2 Thank you for sharing your idea.

I never used the KV Store lookup. I will explore on it.

Could you please check if you can help me on the below:

As explained in my main question, in Dashboard Panel 1 there are multiple rows. Each row has "COMMENTS" field. I want to display the text box only if the user clicks on any row/column.

Let's say user clicked on row 1 COMMENTS field, then I want to show test box to user so that he can input the data into it, when he clicked submit, I want to save the "Entered" data into COMMENTS field of row 1.

Is something we can do like this?

Re: Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

potnuru — Mon, 19 Oct 2020 06:50:15 GMT

Hi @woodcock, Could you please help me on this?

Re: Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

woodcock — Mon, 19 Oct 2020 13:52:04 GMT

So potentially every user might have his own comment for every row? Depending on users, that could really blow up in a big way.

You could look at how the ES app handles `investigations` using KV store. You also need the `authentication` rest endpoint to get your users' login IDs.

Re: Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

potnuru — Mon, 19 Oct 2020 16:35:25 GMT

@woodcock

So potentially every user might have his own comment for every row?

All the table data (for all Users) is fetched from an index except Comments field.

Administrator will access the dashboard to view and to approve/reject each row item with comments.

So, Basically if the administrator is already approved/rejected a row, it should be shown in the dashboard so that he can take actions on other items.