How to add a comment text box to Splunk Dashboard ?

[utk123]

I have a dashboard for daily alerts, and I want to add a comment text box at extreme right of it for team to add comments.

Splunk query:
index=firewall (IP="10.10.10." OR IP="10.10.20." OR IP="100.100.20.*") (Status=deny)
| stats count(IP) As "Hits" by SrcIP, DstIP, Port, Status

Results in table format:
SrcIP DstIP Port Status Hits
10.10.10.1 10.10.10.2 80 deny 11
10.10.20.1 10.10.10.2 443 deny 45

I want to add a Comments text box to extreme right, so that the table will look like this:

SrcIP DstIP Port Status Hits Comments
10.10.10.1 10.10.10.2 80 deny 11
10.10.20.1 10.10.10.2 443 deny 45

how to add this on splunk dashboard ?

[niketn]

@utk123 refer to one of my older answers on similar lines. You would need to create JS based solution to update KV Store using Splunk REST API. https://answers.splunk.com/answers/682183/how-to-add-a-textbox-as-a-cell-in-a-splunk-table.html

[gaurav_maniar]

so where these comment should be stored?
if user changes or refresh the page, the comment will be gone. Also it will not be available on other user's dashboard.

[anmolpatel]

This will help you get started

In order to enable the team to add comments, you would want to create a new html panel, which has the following functionality:
1) create a KV store which stores reference to the unique identifier for the result along with the comment column
2) on click of the above panel, it populates the the html panels fields with the comment and reference to the _key field
3) allow the user to update the comments only
4) on clicking the save / update button, a search runs in the background which updates the KV store row using the _key reference and then also refreshes the initial panel

Once the JS and HTML are working,
1) Update your search to include | lookup to the KV store and returns the comments added by the team

[utk123]

Hi gaurav_maniar,

maybe the comments can be saved to a lookup file ? and everytime someone adds a comment it gets save in same lookup file, and pulled from there.
Not sure if that will work, so need suggestions.