Solved: Re: Button to run splunk query

astatrial · ‎02-06-2019

Hello

I'm pretty new to the Dashboard creating in splunk, and to xml in general.

I want to know if there is a way to create a button that will run a splunk search on a click.

I'm trying to create a button that if is clicked, it will create a lookup file by the next search :

| inputlookup "template.csv" | outputlookup "newlookup"."csv"

I know that there is an option to use java script through onclick but the problem is that the query is in splunk syntax and i don't think java script can parse it.

Also can i create this button to appear only if there is a value in other input ?

Can anyone help?

chrisyounger · ‎02-06-2019

Setup your dashboard like this:

<dashboard script="run_action.js">
  <label>Test Action</label>
  <row>
    <panel>
      <html>
        <button class="btn btn-primary button1">Run search!</button>
      </html>
    </panel>
  </row>
</dashboard>

the add run_action.js to <app_folder>/appserver/static of the

         require([
            "jquery",
            "splunkjs/mvc/searchmanager",
            "splunkjs/mvc/simplexml/ready!"
          ], function(
              $,
              SearchManager
          ) {
              var mysearch = new SearchManager({
                  id: "mysearch",
                  autostart: "false",
                  search: "|makeresults| outputlookup myfile" 
              });
              $(".button1").on("click", function (){
                  var ok = confirm("Are you sure?");
                  if (ok){
                      mysearch.startSearch();
                      alert('attempted restart!');
                  } //else {
                  //    alert('user did not click ok!');
                  //}
              });
         });

The dashboard needs to be in the same splunk "app" as the javascript file.

View solution in original post

michael_vi · ‎11-27-2021

The dashboard executes when the page refreshes + when the button is pressed.

How to disable the "refresh" page?

chrisyounger · ‎02-06-2019

Setup your dashboard like this:

<dashboard script="run_action.js">
  <label>Test Action</label>
  <row>
    <panel>
      <html>
        <button class="btn btn-primary button1">Run search!</button>
      </html>
    </panel>
  </row>
</dashboard>

the add run_action.js to <app_folder>/appserver/static of the

         require([
            "jquery",
            "splunkjs/mvc/searchmanager",
            "splunkjs/mvc/simplexml/ready!"
          ], function(
              $,
              SearchManager
          ) {
              var mysearch = new SearchManager({
                  id: "mysearch",
                  autostart: "false",
                  search: "|makeresults| outputlookup myfile" 
              });
              $(".button1").on("click", function (){
                  var ok = confirm("Are you sure?");
                  if (ok){
                      mysearch.startSearch();
                      alert('attempted restart!');
                  } //else {
                  //    alert('user did not click ok!');
                  //}
              });
         });

The dashboard needs to be in the same splunk "app" as the javascript file.

robertlynch2020 · ‎09-02-2021

HI

I have done below and replaced the SPL with the following.

BUt the .sh scripts run when I load the page the first time, how can I stop that from happening.

I would like it to work just when I press the button.

Regards

Robert

A simple | runshellscript Test_Script123.sh 1 1 1 1 1 1 1 1 .

require([
            "jquery",
            "splunkjs/mvc/searchmanager",
            "splunkjs/mvc/simplexml/ready!"
          ], function(
              $,
              SearchManager
          ) {
              var mysearch = new SearchManager({
                  id: "mysearch",
                  autostart: "false",
                  search: "| runshellscript Test_Script123.sh 1 1 1 1 1 1 1 1" 
              });
              $(".button1").on("click", function (){
                  var ok = confirm("Are you sure?");
                  if (ok){
                      mysearch.startSearch();
                      alert('attempted restart!');
                  } //else {
                  //    alert('user did not click ok!');
                  //}
              });
         });

rodrigrc · ‎08-27-2020

I have also the same problem.. I want search particular parameter inside the host file with the selectable date drop down

Below source code only shows one field and also not giving any output.

++++++++++

<form>
<label>ODSEE Backend SEARCH</label>
<fieldset autoRun="false" submitButton="true">
<input type="text" token="twguid">
<label>Search ID</label>
<default>put your search here</default>
<prefix>'twguid'="</prefix>
<suffix>"</suffix>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
index=auth_odsee* host="*" conn=* twguid=*
| search $twguid$
| table '_date' 'twguid' 'host' </query>
<earliest>-10m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>

+++++++++++++++++++++

astatrial · ‎02-07-2019

I did it but for some reason it doesn't work.
Nothing happens when i press the button.

Also is there a way to send a token (of one of the other inputs in the dashboard) to that java script ?

Thank you very much!!

astatrial · ‎05-06-2019

I managed to get it work, based on your answer.
Thanks !

Button to run splunk query

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?