topic How to modify a dashboard in Splunk Search

How to modify a dashboard

AleCanzo — Thu, 12 Jun 2025 12:43:47 GMT

Hi, i'm searching for a way to modify my app/dashboard to be able to modify the entries of a table (such as delete/duplicate/copy/multiselect rows). Any suggestions? Maybe i have to look at the scripts from the lookup editor app? I really don't know where to start. I know how to write in python but i haven't created a script already. Thanks 🙂Dashboard view

Re: How to modify a dashboard

bowesmana — Fri, 13 Jun 2025 04:58:08 GMT

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

Update would

| inputlookup your_table.csv | eval field1=if(this_row=row_to_update, new_field1, old_field1) ... for each field | outputlookup your_table.csv

and delete would

| inputlookup your_table.csv | where event!=event_to_delete | outputlookup your_table.csv

We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

Re: How to modify a dashboard

AleCanzo — Fri, 13 Jun 2025 07:21:42 GMT

Thank you @bowesmana !