@chitreshakumar, following is a simple example for the approach required.
I have created a lookup file with name <your_Splunk_app_name>_<logged_in_username>.csv. This stores a row with the current dashboard name and inputs you have selected. You can implement a KV Store on similar lines for better maintenance. Also JavaScript can be extended to generate the query to pull all inputs available in the dashboard and dynamically populate in csv. Current implementation is static where each input needs to be added to be saved in csv and to be pulled back on dashboard load.
The run anywhere example loads with 24 hours as default time and Log Level as All by default until the Selected inputs are saved
Once the Selected Inputs are saved, on reloading the dashboard, the default values of inputs i.e. 24 hours for time and All for log level is overridden with the saved values.
Following is the Run any where dashboard Simple XML:
<form script="save_inputs.js">
<label>Save Logged In User Selection</label>
<search>
<query>| inputlookup "$env:app$_$env:user$".csv where tokDashboardName="$env:page$"
| table tokTime_earliest tokTime_latest tokLogLevel
</query>
<done>
<condition match="$job.resultCount$!=0">
<set token="form.tokTime.earliest">$result.tokTime_earliest$</set>
<set token="form.tokTime.latest">$result.tokTime_latest$</set>
<set token="form.tokLogLevel">$result.tokLogLevel$</set>
<set token="tokTime.earliest">$result.tokTime_earliest$</set>
<set token="tokTime.latest">$result.tokTime_latest$</set>
<set token="tokLogLevel">$result.tokLogLevel$</set>
</condition>
</done>
</search>
<search>
<query>| makeresults
| eval tokSave="$tokSave$"
| fields - tokSave
| eval tokTime_earliest="$tokTime.earliest$"
| eval tokTime_latest="$tokTime.latest$"
| eval tokLogLevel="$tokLogLevel$"
| eval tokDashboardName="$env:page$"
| outputlookup "$env:app$_$env:user$".csv
</query>
</search>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="time" token="tokTime" searchWhenChanged="true">
<label>Select Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="tokLogLevel" searchWhenChanged="true">
<label>Select Log Level</label>
<choice value="*">All</choice>
<choice value="ERROR">Error</choice>
<choice value="WARN">Warning</choice>
<default>*</default>
</input>
<html>
<style>
#saveButtonLabel{
float:right;
}
#saveButton{
float:right;
}
</style>
<div id="saveButtonLabel">Click the Save button after changing the input selection to be used later!</div>
<br/></br>
<br/></br>
<button id="saveButton" class="btn">Save Inputs</button>
</html>
</panel>
</row>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=splunkd log_level!="INFO" log_level="$tokLogLevel$"
| stats count by component
| sort - count
| head 10</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</form>
Following is the code for JavaScript file save_inputs.js
require([
"splunkjs/mvc",
"splunkjs/mvc/simplexml/ready!"
], function(
mvc
) {
var defaultTokenModel = mvc.Components.get("default");
var submittedTokenModel = mvc.Components.get("submitted");
$("#saveButton").click(function(){
defaultTokenModel.set("tokSave","true");
submittedTokenModel.set("tokSave","true");
alert("Selected Inputs Saved!");
});
});
PS: Simple XML JavaScript extension is required if you need to Save Input button in your dashboard. If you can use Splunk's Check Box input instead, then you will not need JavaScript.
For the JavaScript to work your would need to place the above JavaScript file under your Splunk App's appserver/static folder.
$SPLUNK_HOME$/etc/apps/<YourAppName>/appserver/static/save_inputs.js
You may need to refresh/bump/restart Splunk and even close internet browser history for your changes to work.
