Add a column with comments in the table and update it accourding to drop down

[deepthi5]

Hello All,

I have a dashboard for vulnerability tracking but i would like to add some custom changes for example 

Vuln_number	dv_risk_rating	dv_assignment_group	short_description
VIT9662368	2 - High	XYZ	R7-msft-cve-2024-38077 detected on
VIT9662366	2 - High	XYZ	R7-msft-cve-2024-38074 detected on
VIT9662367	2 - High	XYZ	R7-msft-cve-2024-38076 detected on ics028159223
VIT9662265	2 - High	XYZ	R7-msft-cve-2024-38077 detected on
VIT9662260	2 - High	XYZ	R7-msft-cve-2024-38074 detected on

I need a table with comments in the status column ( The comments are static either there is no action or i have to fix in next release or exception ) so only 3 Can i give that as a dropdown and then select that Vulnerability and assign status from drop down Status

Status_dropdown

No Action

Fix in next release

Exception Raised

dv_number	dv_risk_rating	dv_assignment_group	short_description	status
VIT9662368	2 - High	XYZ	R7-msft-cve-2024-38077 detected on	No action
VIT9662366	2 - High	XYZ	R7-msft-cve-2024-38074 detected on	Fix in next release
VIT9662367	2 - High	XYZ	R7-msft-cve-2024-38076 detected on	Exception Raised
VIT9662265	2 - High	XYZ	R7-msft-cve-2024-38077 detected on	Fix in next release
VIT9662260	2 - High	XYZ	R7-msft-cve-2024-38074 detected on	No action

[PickleRick]

But this "comment" should be saved somehow or what? Where would it come from?

[deepthi5]

yes the comment should be saved 

[gcusello]

Hi @deepthi5 ,

you have to create a lookup containing all the rows from your search,

then in a dashboard you must have two panels:

the first that list all the rows of your lookup, then choosing one row to update, using a dropdown input you can update that row in the lookup.

remember to use a kv-store and not a csv lookup.

It isn't so easy, but the process is the one I described.

here you can find a sample for a similar request I shared some months ago: https://community.splunk.com/t5/Dashboards-Visualizations/Dynamically-Update-a-lookup-file-on-click-... 

Ciao.

Giuseppe