topic Forms in Splunk in Dashboards & Visualizations

Forms in Splunk

urvishah — Mon, 24 Mar 2025 08:31:46 GMT

Hi, From what I read so far, Splunk forms can be used to fetch/filter data based on User's requirement. The data in the case is already present in Splunk. However, I wish to insert data into specific Index in Splunk. Can this also be done using Splunk Forms?

Re: Forms in Splunk

livehybrid — Mon, 24 Mar 2025 08:37:02 GMT

Hi @urvishah

Are you wanting to allow users to write data to a Splunk index without being logged in to Splunk itself? If so you would need an external site/system which then sends the collected form data to a HEC receiver to be indexed in Splunk.

If you want something within Splunk itself then you can use a Dashboard with multiple text inputs/dropdowns etc. You can then use the tokens from these inputs to build a search with a "collect" statement that would populate your index.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Forms in Splunk

isoutamo — Mon, 24 Mar 2025 08:48:17 GMT

basically yes as @livehybrid already said. There are also other ways to store end user's answers into splunk, but what is best is depending on your use case. Those are e.g. kvstore, csv file, db connect etc.

If you need more specific answer, then you should told your use case and what you looking for.

r. Ismo