topic Re: splunk dashboard in Splunk Search

splunk dashboard

SN1 — Wed, 23 Apr 2025 07:42:35 GMT

So i have a dashboard and in drilldown i am showing severity in the servers now i want whenever the severity is solved that severity is removed from the drilldown and store somewhere else for confirmation.

from this table if i solve any severity i should be able to remove it from here and store it somewhere else.
and if by mistake i have removed it , i can rollback .

Re: splunk dashboard

ITWhisperer — Wed, 23 Apr 2025 08:36:26 GMT

Please explain where the data for this table comes from e.g. the search used. Also, how do you "solve" a "severity" and how does this mean it is removed from this table. Please explain where "somewhere else" is and how you "confirmation" is performed. Please explain how rollback works (or is expected to work).

Re: splunk dashboard

livehybrid — Wed, 23 Apr 2025 09:41:02 GMT

Hi @SN1

It sounds like you want to maintain a lookup of alarms which you have dealt with.

Its hard to say exactly without your existing search but I would do the following:

U se a lookup command to match the event - use the OUTPUTNEW capability to output a field in the lookup as a new fieldname (e.g. | lookup myLookup myField1 myField2 OUTPUTNEW myField1 AS matchedField)
Use the where command to filter out those where matchedField is empty/null

This should result in just a list of events that were NOT in the lookup.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: splunk dashboard

SN1 — Thu, 24 Apr 2025 08:03:46 GMT

i want to implement it using JS is it possible?

Re: splunk dashboard

livehybrid — Thu, 24 Apr 2025 08:30:24 GMT

Hi @SN1

Sorry Im not sure I fully understand - what is it you are wanting to implement with JS?

Re: splunk dashboard

SN1 — Thu, 24 Apr 2025 08:47:27 GMT

ok so i have a drilldown

so in this table there is a field solved which have default value 0 which means this particular severity is not solved . Now i want a button instead of 0 .like this

now whenever a severity is being solved then when we click on this button it should change like this

and this specific result its value (solve field ) should be changed to 1.

this is JS i am using but it is not working.

plus ye script thi jo mai use kar raha hun

require([
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/searchmanager',
    'splunkjs/mvc',
    'underscore',
    'splunkjs/mvc/simplexml/ready!'
], function(
    TableView,
    SearchManager,
    mvc,
    _
) {
    var CustomLinkRenderer = TableView.BaseCellRenderer.extend({
        canRender: function(cell) {
            return cell.field === 'solved';
        },

        render: function($td, cell) {
            var solved = cell.value;
            var rowKey = cell.data.row.rowKey;

            var icon = $('<a>')
                .attr("href", "#")
                .attr("title", "Mark as Solved")
                .css({
                    "cursor": "pointer",
                    "text-align": "center",
                    "display": "inline-block",
                    "width": "100%"
                });

icon.html('<i class="icon ' + (solved === "1" ? 'icon-check-circle' : 'icon-minus-circle') + '"></i>');

icon.on("click", function(e) {
e.preventDefault();

var $icon = $(this).find('i');

                // Only run update if not already solved
                if (solved === "1") {
                    return; // Already marked as solved
                }

$icon.removeClass("icon-minus-circle").addClass("icon-gear");

                var updateSearch = `
                    | inputlookup sbc_major.csv
                    | eval rowKey=tostring(rowKey)
                    | eval match=if(rowKey="${rowKey}", "1", "0")
                    | eval solved=if(match="1", "1", solved)
                    | fields - match
                    | outputlookup sbc_major.csv
                `;

                var updateManager = new SearchManager({
                    id: "update-solved-" + _.uniqueId(),
                    preview: false,
                    cache: false,
                    search: updateSearch
                });

                updateManager.on("search:done", function() {
                    $icon.removeClass("icon-gear").addClass("icon-check-circle");
                });
            });

            $td.empty().append(icon);
        }
    });

    var tableElement = mvc.Components.getInstance("sbc_alarm_table");
    tableElement.getVisualization(function(tableView) {
        tableView.table.addCellRenderer(new CustomLinkRenderer());
        tableView.table.render();
    });
});

Re: splunk dashboard

molla — Thu, 24 Apr 2025 13:13:03 GMT

Hi,

if I understood right your requirement, you can add a button with JS in the table.
When the button is clicked, it will trigger a splunk search to update a lookup where you will save the status change of the field solved.

After the search is complete you can re-run the search in the table so see the update. You have also to change the search in the table in order to get the last updated value for the field solved.

This flow can be done using JS.

require([ 'splunkjs/mvc', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!', 'jquery' ], function(mvc, SearchManager, TableView, ignored, $) { // Define a simple cell renderer with a button var ActionButtonRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return cell.field === 'myfieldwheredispaybutton'; }, render: function($td, cell) { $td.addClass('button-cell'); var $btn = $('<button class="btn btn-primary">Execute</button>'); $btn.on('click', function(e) { e.preventDefault(); e.stopPropagation(); var rowId = cell.value; // value from the cell (e.g., unique row ID) console.log("Button clicked for row:", rowId); var searchQuery = `| makeresults | eval row_id=\"${rowId}\", _time=now() | outputlookup append=true custom_lookup.csv`; var writeSearch = new SearchManager({ id: "writeSearch_" + Math.floor(Math.random() * 100000), search: searchQuery, autostart: true }); writeSearch.on('search:done', function() { console.log("Search completed and lookup updated"); var panelSearch = mvc.Components.get('panel_search_id'); if (panelSearch) { panelSearch.startSearch(); console.log("Panel search restarted"); } }); }); $td.append($btn); } }); // Apply the renderer to the specified table var tableComponent = mvc.Components.get('generic_table_id'); if (tableComponent) { tableComponent.getVisualization(function(tableView) { tableView.table.addCellRenderer(new ActionButtonRenderer()); tableView.table.render(); }); } });