Creating an Interactive Button to run SPL in Dashboard Studio

[Ian0706]

Hello everyone,

I am trying to create a dashboard that modifies and reads from lookup files. The way i want this to function is by having a button to run a spl command that adds to the csv based on user input. Is this possible with the newer dashboard studio, or will I need to revert to the classic dashboards?

[tscroggins]

Hi @Ian0706,

You can use a button to set lookup field tokens from input tokens and then reference the lookup field tokens in a visualization search. Using two sets of tokens prevents the visualization search from running until the dashboard user has clicked the button. It isn't pretty, but it works.

Here's a simple example using inputlookup and outputlookup to prepend a row to a lookup file. By default, the outputlookup command is considered risky, and the user will be prompted to run the command. You can override this behavior for your dashboard by bundling the dashboard in a separate application and modifying the app default/commands.conf [outputlookup] stanza is_risky setting.

# $SPLUNK_HOME/etc/apps/Ian0706_dashboard_app/default/commands.conf
[outputlookup]
is_risky = false

{
    "title": "Ian0706_lookup_edit",
    "description": "",
    "inputs": {
        "input_AkAODjk5": {
            "options": {
                "defaultValue": "value3",
                "token": "text_field3"
            },
            "title": "field3",
            "type": "input.text"
        },
        "input_H4MpaoX8": {
            "eventHandlers": [
                {
                    "options": {
                        "tokens": [
                            {
                                "token": "field1_value",
                                "value": "$text_field1$"
                            },
                            {
                                "token": "field2_value",
                                "value": "$text_field2$"
                            },
                            {
                                "token": "field3_value",
                                "value": "$text_field3$"
                            }
                        ]
                    },
                    "type": "drilldown.setToken"
                }
            ],
            "options": {
                "label": "Add Row"
            },
            "type": "input.button"
        },
        "input_farf9Mcm": {
            "options": {
                "defaultValue": "value1",
                "token": "text_field1"
            },
            "title": "field1",
            "type": "input.text"
        },
        "input_m57JMGPh": {
            "options": {
                "defaultValue": "value2",
                "token": "text_field2"
            },
            "title": "field2",
            "type": "input.text"
        }
    },
    "visualizations": {
        "viz_rJEtNnZs": {
            "containerOptions": {
                "visibility": {}
            },
            "dataSources": {
                "primary": "ds_aS8qB1WF"
            },
            "type": "splunk.table"
        }
    },
    "dataSources": {
        "ds_aS8qB1WF": {
            "name": "Search_1",
            "options": {
                "query": "| makeresults\n| eval field1=$field1_value|s$\n| eval field2=$field2_value|s$\n| eval field3=$field3_value|s$\n| inputlookup append=t Ian0706.csv\n| outputlookup Ian0706.csv",
                "queryParameters": {
                    "earliest": "0",
                    "latest": ""
                }
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [
            "input_farf9Mcm",
            "input_m57JMGPh",
            "input_AkAODjk5",
            "input_H4MpaoX8"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "options": {
                    "height": 960,
                    "width": 1440
                },
                "structure": [
                    {
                        "item": "viz_rJEtNnZs",
                        "position": {
                            "h": 400,
                            "w": 1440,
                            "x": 0,
                            "y": 0
                        },
                        "type": "block"
                    }
                ],
                "type": "grid"
            }
        },
        "options": {},
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}

[ITWhisperer]

Why not use the splunk app for lookup file editing? https://splunkbase.splunk.com/app/1724

[Ian0706]

The goal for the dashboard was to allow easy formatting via SPL, and then merging into a final csv. It flows as such: imported.csv -> SPL -> ioc.csv, this is to allow some obfuscation for lower level analysts. But I would also like to know if the button is even possible.

[bowesmana]

I'm not aware that it can be done in DS with a button in the way that XML can do it, but is it possible using a single value display with drilldown that sets a token that the second search that does the CSV updates can use.

However, in the XML way, normally you'd manage it is to nullify the token after the update, so it can ru-run, but I'm not sure how to do that in DS.