@christoffertoft, I created button behavior using Checkbox just to avoid JavaScript, as that is what mostly gets asked 🙂 You are right with JavaScript you can implemented whatever your want. So please find below run anywhere dashboard with similar out as above, but it uses Splunk Style Submit Button to Push search results to Lookup using JavaScript. PS: The outputlookup query building the lookup file on Button click is reset on changing the time range using Simple XML change event handler for dropdown input. This is also used to hide the results from lookup file which is only displayed after button is clicked and new search results are pushed to lookup file.
Following is the Run anywhere Simple XML dashboard code:
<form script="push_to_csv.js">
<label>Click Button to Push Results to CSV Lookup Using JS</label>
<!-- Run only on Click on Submit -->
<search base="baseQuery">
<query>$tokQueryOutputLookup$</query>
</search>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<title>Query to Generate Source Table</title>
<input type="dropdown" token="tokDay" searchWhenChanged="true">
<label>Get Previous Day Stats</label>
<choice value="earliest=-0d@d latest=now">Today</choice>
<choice value="earliest=-1d@d latest=-0d@d">Yesterday</choice>
<choice value="earliest=-7d@d latest=-6d@d">Last Week Same Day</choice>
<default>earliest=-7d@d latest=-6d@d</default>
<change>
<unset token="tokQueryOutputLookup"></unset>
</change>
</input>
<table>
<search id="baseQuery">
<query>index=_internal sourcetype=splunkd log_level!=INFO $tokDay$
| bin _time span=15m
| stats count as Errors by _time
| timechart span=1h sum(Errors) as Errors avg(Errors) as Average min(Errors) as Minimum perc25(Errors) as Percentile25 perc75(Errors) as Percentile75 max(Errors) as Maximum
| fillnull value=0
| eval Average=round(Average)
| eval perc75=round(perc75)
| table _time Errors Minimum Average Percentile75 Maximum</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel>
<html>
<div>
<a id="btnSubmitCSV" class="btn btn-primary pull-right">Push Results to CSV</a>
</div>
</html>
<table depends="$tokQueryOutputLookup$">
<title>Result from Destination CSV File</title>
<search>
<query>| inputlookup test.csv
| eval token="$tokQueryOutputLookup$"
| table _time Errors Minimum Average Percentile75 Maximum</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<progress>
<condition match="$job.resultCount$=0">
<unset token="tokShowOutput"></unset>
</condition>
<condition>
<set token="tokShowOutput"></set>
</condition>
</progress>
</search>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Following is the code for push_to_csv.js JavaScript invoked on clicking the Submit Button using jQuery Selector for button i.e. id="btnSubmitCSV".
require([
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function($,mvc){
var defaultTokens = mvc.Components.get("default");
var submittedTokens = mvc.Components.get("submitted");
$('#btnSubmitCSV').on("click",function(){
// Change the value of a token $tokQueryOutputLookup$
submittedTokens.set("tokQueryOutputLookup", "| outputlookup test.csv");
defaultTokens.set("tokQueryOutputLookup", "| outputlookup test.csv");
});
});
Please try out and confirm.
