Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Button to run splunk query
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
I'm pretty new to the Dashboard creating in splunk, and to xml in general.
I want to know if there is a way to create a button that will run a splunk search on a click.
I'm trying to create a button that if is clicked, it will create a lookup file by the next search :
| inputlookup "template.csv" | outputlookup "newlookup"."csv"
I know that there is an option to use java script through onclick but the problem is that the query is in splunk syntax and i don't think java script can parse it.
Also can i create this button to appear only if there is a value in other input ?
Can anyone help?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Setup your dashboard like this:
<dashboard script="run_action.js">
<label>Test Action</label>
<row>
<panel>
<html>
<button class="btn btn-primary button1">Run search!</button>
</html>
</panel>
</row>
</dashboard>
the add run_action.js to <app_folder>/appserver/static of the
require([
"jquery",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/simplexml/ready!"
], function(
$,
SearchManager
) {
var mysearch = new SearchManager({
id: "mysearch",
autostart: "false",
search: "|makeresults| outputlookup myfile"
});
$(".button1").on("click", function (){
var ok = confirm("Are you sure?");
if (ok){
mysearch.startSearch();
alert('attempted restart!');
} //else {
// alert('user did not click ok!');
//}
});
});
The dashboard needs to be in the same splunk "app" as the javascript file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The dashboard executes when the page refreshes + when the button is pressed.
How to disable the "refresh" page?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Setup your dashboard like this:
<dashboard script="run_action.js">
<label>Test Action</label>
<row>
<panel>
<html>
<button class="btn btn-primary button1">Run search!</button>
</html>
</panel>
</row>
</dashboard>
the add run_action.js to <app_folder>/appserver/static of the
require([
"jquery",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/simplexml/ready!"
], function(
$,
SearchManager
) {
var mysearch = new SearchManager({
id: "mysearch",
autostart: "false",
search: "|makeresults| outputlookup myfile"
});
$(".button1").on("click", function (){
var ok = confirm("Are you sure?");
if (ok){
mysearch.startSearch();
alert('attempted restart!');
} //else {
// alert('user did not click ok!');
//}
});
});
The dashboard needs to be in the same splunk "app" as the javascript file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI
I have done below and replaced the SPL with the following.
BUt the .sh scripts run when I load the page the first time, how can I stop that from happening.
I would like it to work just when I press the button.
Regards
Robert
A simple | runshellscript Test_Script123.sh 1 1 1 1 1 1 1 1 .
require([
"jquery",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/simplexml/ready!"
], function(
$,
SearchManager
) {
var mysearch = new SearchManager({
id: "mysearch",
autostart: "false",
search: "| runshellscript Test_Script123.sh 1 1 1 1 1 1 1 1"
});
$(".button1").on("click", function (){
var ok = confirm("Are you sure?");
if (ok){
mysearch.startSearch();
alert('attempted restart!');
} //else {
// alert('user did not click ok!');
//}
});
});
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have also the same problem.. I want search particular parameter inside the host file with the selectable date drop down
Below source code only shows one field and also not giving any output.
++++++++++
<form>
<label>ODSEE Backend SEARCH</label>
<fieldset autoRun="false" submitButton="true">
<input type="text" token="twguid">
<label>Search ID</label>
<default>put your search here</default>
<prefix>'twguid'="</prefix>
<suffix>"</suffix>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
index=auth_odsee* host="*" conn=* twguid=*
| search $twguid$
| table '_date' 'twguid' 'host' </query>
<earliest>-10m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>
+++++++++++++++++++++
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did it but for some reason it doesn't work.
Nothing happens when i press the button.
Also is there a way to send a token (of one of the other inputs in the dashboard) to that java script ?
Thank you very much!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I managed to get it work, based on your answer.
Thanks !
Observe and Secure All Apps with Splunk
What's New in Splunk Observability - August 2025
Introduction to Splunk AI
