Dashboards & Visualizations

Button click to run a SPL search containing a token from dashboard

Explorer

I need to build a js script that will run a splunk search when I click a button on my dashboard.

The search within the .js file needs to: (1) get a token I have set on the dashboard which is $host_tok$ and (2) append the search results to a kv store (named: collected-data) I already have setup.

I would also like the js script to ask for confirmation (yes/no) "Are you sure you want to add $host_tok$ data to the collected-data kv store?" Clicking yes will run the search. Clicking no will close the notification window.

I have a basic understanding of js, but I don't work with it enough to remember how I would build this script.

dashboard xml:

    <form script="run_action_test.js">
      <fieldset submitButton="false">
        <input id="host" type="dropdown" token="host_tok">
          <label>Host</label>
          <fieldForLabel>host</fieldForLabel>
          <fieldForValue>host</fieldForValue>
          <search>
            <query>index=main sourcetype=test | stats count by host</query>
            <earliest>$time_tok.earliest$</earliest>
            <latest>$time_tok.latest$</latest>
          </search>
          <prefix>host=</prefix>
        </input>
        <input type="time" token="time_tok">
          <label></label>
          <default>
            <earliest>-7d@h</earliest>
            <latest>now</latest>
          </default>
        </input>
      </fieldset>
    ...
      <row>
        <panel>
          <html
             <buttton class="btn btn-primary button1">Copy to KV Store!</button>
          </html>
        </panel>
      </row>
    ...
0 Karma
1 Solution

SplunkTrust
SplunkTrust

@alinadejeu refer to one of my older answers on similar lines https://answers.splunk.com/answers/600664/dashboard-button-to-run-spl-on-click.html

You would need to adjust as per your needs like add Ok/Cancel confirm() box in the JavaScript code.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@alinadejeu refer to one of my older answers on similar lines https://answers.splunk.com/answers/600664/dashboard-button-to-run-spl-on-click.html

You would need to adjust as per your needs like add Ok/Cancel confirm() box in the JavaScript code.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Explorer

Thank I was able to do what I needed with a simple savedsearched for now.

0 Karma