topic Re: How to launch an action from dashboard in Dashboards & Visualizations

How to launch an action from dashboard

dreadangel — Fri, 26 Apr 2019 13:53:24 GMT

My splunk contains an index_main which collects events with next (simplified) format

id, status, description

A dashboard contains a dropdown, which loads via dedup status, and a table which loads the events filtered by dropdown's selected value.
The goal is, via dashboard, to copy the events from index_main to other indexes based on dropdown's value - as status fields admits (Info, Error, Critical) values, then data should be copied to index_info, index_error and index_critical indexes (indexes already exists) - I plan to use collect but I see no solution how to launch the script.

Any thoughts upon this kind of integration? Or I miss something?

Re: How to launch an action from dashboard

adonio — Fri, 26 Apr 2019 15:07:29 GMT

what is the problem you are trying to solve?
seems like with your method every click / interaction with the dashboard should send results to summary index, is that what you are trying to achieve?

Re: How to launch an action from dashboard

woodcock — Sat, 27 Apr 2019 01:02:26 GMT

The collect command is not part of a script, it is SPL, so it is trivial. Just have a panel with something like this:

index="index_main" AND status=$dropdown_token$ | dedup status | addinfo | collect index=index_$dropdown_token$

Re: How to launch an action from dashboard

dreadangel — Tue, 30 Apr 2019 07:14:15 GMT

Actually, I found my answer here (https://answers.splunk.com/answers/600664/dashboard-button-to-run-spl-on-click.html). Thank you all for your assistance.