Dashboards & Visualizations

How to add a comment text box to Splunk Dashboard ?

Path Finder

I have a dashboard for daily alerts, and I want to add a comment text box at extreme right of it for team to add comments.

Splunk query:
index=firewall (IP="10.10.10." OR IP="10.10.20." OR IP="100.100.20.*") (Status=deny)
| stats count(IP) As "Hits" by SrcIP, DstIP, Port, Status

Results in table format:
SrcIP DstIP Port Status Hits 80 deny 11 443 deny 45

I want to add a Comments text box to extreme right, so that the table will look like this:

SrcIP DstIP Port Status Hits Comments 80 deny 11 443 deny 45

how to add this on splunk dashboard ?

Tags (4)
0 Karma


@utk123 refer to one of my older answers on similar lines. You would need to create JS based solution to update KV Store using Splunk REST API. https://answers.splunk.com/answers/682183/how-to-add-a-textbox-as-a-cell-in-a-splunk-table.html

| makeresults | eval message= "Happy Splunking!!!"
0 Karma


so where these comment should be stored?
if user changes or refresh the page, the comment will be gone. Also it will not be available on other user's dashboard.

0 Karma


This will help you get started

In order to enable the team to add comments, you would want to create a new html panel, which has the following functionality:
1) create a KV store which stores reference to the unique identifier for the result along with the comment column
2) on click of the above panel, it populates the the html panels fields with the comment and reference to the _key field
3) allow the user to update the comments only
4) on clicking the save / update button, a search runs in the background which updates the KV store row using the _key reference and then also refreshes the initial panel

Once the JS and HTML are working,
1) Update your search to include | lookup to the KV store and returns the comments added by the team

0 Karma

Path Finder

Hi gaurav_maniar,

maybe the comments can be saved to a lookup file ? and everytime someone adds a comment it gets save in same lookup file, and pulled from there.
Not sure if that will work, so need suggestions.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>