- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Add a column with comments in the table and update it accourding to drop down
Hello All,
I have a dashboard for vulnerability tracking but i would like to add some custom changes for example
Vuln_number | dv_risk_rating | dv_assignment_group | short_description |
VIT9662368 | 2 - High | XYZ | R7-msft-cve-2024-38077 detected on |
VIT9662366 | 2 - High | XYZ | R7-msft-cve-2024-38074 detected on |
VIT9662367 | 2 - High | XYZ | R7-msft-cve-2024-38076 detected on ics028159223 |
VIT9662265 | 2 - High | XYZ | R7-msft-cve-2024-38077 detected on |
VIT9662260 | 2 - High | XYZ | R7-msft-cve-2024-38074 detected on |
I need a table with comments in the status column ( The comments are static either there is no action or i have to fix in next release or exception ) so only 3 Can i give that as a dropdown and then select that Vulnerability and assign status from drop down Status
Status_dropdown
No Action
Fix in next release
Exception Raised
dv_number | dv_risk_rating | dv_assignment_group | short_description | status |
VIT9662368 | 2 - High | XYZ | R7-msft-cve-2024-38077 detected on | No action |
VIT9662366 | 2 - High | XYZ | R7-msft-cve-2024-38074 detected on | Fix in next release |
VIT9662367 | 2 - High | XYZ | R7-msft-cve-2024-38076 detected on | Exception Raised |
VIT9662265 | 2 - High | XYZ | R7-msft-cve-2024-38077 detected on | Fix in next release |
VIT9662260 | 2 - High | XYZ | R7-msft-cve-2024-38074 detected on | No action |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

But this "comment" should be saved somehow or what? Where would it come from?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes the comment should be saved
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @deepthi5 ,
you have to create a lookup containing all the rows from your search,
then in a dashboard you must have two panels:
the first that list all the rows of your lookup, then choosing one row to update, using a dropdown input you can update that row in the lookup.
remember to use a kv-store and not a csv lookup.
It isn't so easy, but the process is the one I described.
here you can find a sample for a similar request I shared some months ago: https://community.splunk.com/t5/Dashboards-Visualizations/Dynamically-Update-a-lookup-file-on-click-...
Ciao.
Giuseppe
