topic Re: Delete rows from dashboard in Dashboards & Visualizations

Delete rows from dashboard

Saikat001 — Wed, 09 Jun 2021 17:52:52 GMT

Lets say, i have a dashboard that fetches data from a csv and displays it in table format. i want to delete a particular entry from the table using the dashboard and not by manually opening the csv and deleting the entry. how to achieve this ?

Re: Delete rows from dashboard

ITWhisperer — Wed, 09 Jun 2021 17:56:56 GMT

outputlookup can be used to rewrite the csv file, so create a search that has all but the deleted event in and save that

Re: Delete rows from dashboard

richgalloway — Wed, 09 Jun 2021 18:02:19 GMT

Use the Lookup Editor app. Or add some JavaScript code to the dashboard that accepts user input and sets a field in the row(s) to be deleted. The dashboard then needs to re-write the CSV, omitting the marked row(s).

Re: Delete rows from dashboard

rupkumar4sec — Wed, 09 Jun 2021 19:56:03 GMT

Looks like we have solution for this in another Splunk answer. Check below link once.

https://community.splunk.com/t5/Splunk-Search/I-want-to-modify-Lookup-file-directly-through-the-dashboard/m-p/23073

You may need to play with python little bit.

Re: Delete rows from dashboard

ITWhisperer — Wed, 09 Jun 2021 21:54:49 GMT

Here is a dashboard (without python/javascript/etc.) that allow you to add and remove rows from a csv - it uses only one field which is assumed to be unique (at least as far as deletes are concerned) that is all events with the key equal to the delete value will be removed. This obviously would need modifying for your use case, but could be used as a starting point.

<form> <label>csv editor</label> <fieldset submitButton="false"> <input type="text" token="addvalue" searchWhenChanged="true"> <label>Key to add</label> <change> <eval token="add">$value$</eval> </change> </input> <input type="text" token="delvalue" searchWhenChanged="true"> <label>Key to delete</label> <change> <eval token="delete">$value$</eval> </change> </input> </fieldset> <row> <panel> <table> <search> <query>| inputlookup store.csv | eval dummy=$time$ | table key </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> <panel depends="$alwayshide$"> <table> <search> <query>| makeresults | eval key="$add$" | table key | outputlookup store.csv append=t </query> <done> <eval token="time">now()</eval> </done> </search> </table> </panel> <panel depends="$alwayshide$"> <table> <search> <query>| inputlookup store.csv | where key!="$delete$" | table key | outputlookup store.csv append=f </query> <done> <eval token="time">now()</eval> </done> </search> </table> </panel> </row> </form>

Re: Delete rows from dashboard

ITWhisperer — Thu, 10 Jun 2021 07:01:40 GMT

I should have added that because the key to be deleted is based on a token being set, this could be done through a drill down on the table being viewed, although you still might want to have an "are you sure" step e.g. display the key in another panel or input and click / drilldown from there to send the key for deletion.

Re: Delete rows from dashboard

Saikat001 — Thu, 10 Jun 2021 13:19:36 GMT

This works definitely . Thank you very much . 😁😎

Though one thing to highlight, this would work good for small to medium size csv's. For larger csv's, to delete one Field, the whole csv gets re-written which might face some issues.