Dashboards & Visualizations

Dashboard that contains all of the input tokens values

LinghGroove
Engager

Hello, 

I'm having troubles creating a dashboard panel that can list values inserted by other users. The panel has an input field where users will put specific ip addressess that mast be added to this "list".  The only solution i came up with is a lookup file that will be updated with new rows every time a user adds a value as input. I have tried this query that i saw on https://blog.avotrix.com/how-to-add-new-fields-in-existing-lookup-file/

| inputlookup ip_sospetti append=true
| append
[| stats count
| eval IP="$added_ip_token$"
| table IP]
| outputlookup ip_sospetti.csv

This search adds just one value to the lookup file and when a new input is added it changes the last value inserted. Do you guys have a better solution or maybe an idea to make this query work?

Thanks a lot.

Labels (3)
Tags (1)
0 Karma
1 Solution

VatsalJagani
Champion

@LinghGroove - Try this search query:

| makeresults | eval IP=$added_ip_token|s$
| inputlookup ip_sospetti.csv append=true
| table IP
| outputlookup ip_sospetti.csv

 

I hope this helps!! Karma/upvote would be appreciated!!!

View solution in original post

VatsalJagani
Champion

@LinghGroove - Try this search query:

| makeresults | eval IP=$added_ip_token|s$
| inputlookup ip_sospetti.csv append=true
| table IP
| outputlookup ip_sospetti.csv

 

I hope this helps!! Karma/upvote would be appreciated!!!

LinghGroove
Engager

Hello, thanks a lot for your answer, i really appreciate your help @VatsalJagani. Your solution does indeed work. It adds the input values to the lookup file perfectly. If someone else is interested i have created another query to resolve the problem:

| inputlookup append=true ip_sospetti.csv 
| append
[| stats count
| eval IP="$new_ip_token$"
| table IP]
| fields - _time
| outputlookup ip_sospetti.csv

 Though i think that VatsalJagani solution is way better. Unfortunatly, both with my solution and with the query of Vatsal Jagani another problem have accured. When I close the dashboard and come back to use to insert a new input all the old values inserted disappear. I really don't now why. This is the dashboard: 

 

<form script="run_action.js">
<label>IP verification</label>
<description>new dashboard with table IP</description>
<fieldset submitButton="false" autoRun="false"></fieldset>
<row>
<panel>
<title>Use the botton to eliminate the contents of the table</title>
<html>
<button class="btn btn-primary button1">Run search!</button>
</html>
</panel>
</row>
<row>
<panel>
<title>IP table</title>
<input type="text" token="new_ip_token" searchWhenChanged="true">
<label>Insert IPs to monitor</label>
<default></default>
</input>
<input type="text" token="remove_ip" searchWhenChanged="true">
<label>Insert IPs to remove</label>
</input>
<table>
<title>IP Table</title>
<search>
<query>| makeresults
| eval IP="$new_ip_token$"
| inputlookup ip_sospetti.csv append=true
| table IP
| outputlookup ip_sospetti.csv</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="number" field="IP"></format>
</table>
</panel>
</row>

</form>

 

I thought it is the botton that (even if not used) that erases all the content of the table but it isn't. At this point i don't know how to proced. (i haven't yet started with the IP remove from table functionality).

Again, if someone have a better idea on how to do this i would be so grateful.

Thanks a lot. 

Tags (3)
0 Karma

VatsalJagani
Champion

@LinghGroove - Is there any reason you cannot use the Lookup editor application (https://splunkbase.splunk.com/app/1724/)?

 

I don't understand what is not working for you now. I don't see any reason for the search to empty the lookup.

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...