Hello!
I have a table on my dashboard. There are some fields on this table with are partially filled, And I would want to let the user fill them manually.
For this case I thought about storing the manually edited data on a lookup table (csv), join those fields to my search, and present it in my table. I tried to think about a way of letting the user edit those fields, so I setted a drilldown, which set a token with the selected row key, and an input, in which the user can edit the fields values. After filling those values, the user clicks on submit input button, and the data is written to the lookup table, using a hidden search on the page (which use outputlookup)
Here is an example of how it looks like:
The problem is - I can't update the values on the table after clicking on submit, what makes this a bad solution to my problem. (Well, I can by re-running the query, but I don't want to search again and again every time the user changes a single row (+ splunk doesn't let me re run search on submit unless there is a change in the query, and there isn't)).
I hope someone have a solution or even a better way to solve my problem.
Thanks!
Here are the steps to move lookup Editor Related code to your own Splunk App:
1) Copy Lookup Editor's static folder contents (has sub folders) from $SPLUNK_HOMEetc/apps/lookup_editor/appserver/static to your app $SPLUNK_HOMEetc/apps/<yourAppName>/appserver/static
2) Similarly copy controller folder over to your app i.e.
$SPLUNK_HOMEetc/apps/lookup_editor/appserver/controller to your app $SPLUNK_HOMEetc/apps/<yourAppName>/appserver/controller
(PS: I have not checked whether it is absolutely necessary to copy this over or not)
3) Create a new dashboard in your App with Lookup Edit dashboard code from Lookup Editor App. Following are the changes I have made
i) hideEdit="false" so that we can easily edit the dashboard
ii) Set the token/form token for owner (like admin), Splunk app name (like search), lookup file name (like test.csv) and lookup file type will be csv.
iii) CSS Override to reduce height of panel to display CSV and Change position of Submit Button.
4) Restart Splunk or refresh/bump Splunk
<dashboard script="lookup_edit.js" stylesheet="lookup_edit.css" hideEdit="false">
<label>My Dashboard with imported Lookup Edit</label>
<init>
<set token="form.owner">yourOwnerName</set>
<set token="form.namespace">yourSplunkAppName</set>
<set token="form.lookup">yourCSVFileName.csv</set>
<set token="form.type">csv</set>
<set token="owner">yourOwnerName</set>
<set token="namespace">yourSplunkAppName</set>
<set token="lookup">yourCSVFileName.csv</set>
<set token="type">csv</set>
</init>
<row depends="$alwaysHideCSS$">
<panel>
<html>
<style>
button#save{
margin-left: 10px !important;
position: absolute !important;
top: -15px !important;
}
.row-fluid .span2:first-child{
visibility:hidden !important;
}
#lookup-table{
height:250px !important;
}
</style>
</html>
</panel>
</row>
<row>
<html>
<div id="lookups_editor"></div>
</html>
</row>
</dashboard>
@omerl based on your use case, best option for you is to use KV Store so that you can modify only the value required. Refer to the link provided to see an example of KV Store Implementation. This will create kind of a form for your Users to correct Version of specific IP.
You second preference could be the Lookup Editor App , which will allow you to edit CSV file.
I am attaching a third option using Simple XML. There is a Dropdown for IP Address to be pulled from CSV file using inputlookup command from lookup file ipaddress_splunkversion.csv. You can then use text box to update the value of a particular IP which gets updated back to the lookup file using outputlookup command.
PS: Tabbing out of TextBox updates the lookup.
Please try one of the options and confirm!
<form>
<label>Lookup File Editing</label>
<fieldset submitButton="false">
<input type="dropdown" token="textIPAddress">
<label>IP Address</label>
<fieldForLabel>IPAddress</fieldForLabel>
<fieldForValue>IPAddress</fieldForValue>
<search>
<query>| inputlookup ipaddress_splunkversion.csv
| fields IPAddress</query>
</search>
<change>
<eval token="tokIPAddress">if(len(trim($value$))>0,$value$,"")</eval>
<unset token="textSplunkVersion"></unset>
<unset token="form.textSplunkVersion"></unset>
<set token="tokSplunkVersion"></set>
</change>
</input>
<input type="text" token="textSplunkVersion">
<label>Splunk Version</label>
<change>
<condition match="tokIPAddress=""">
<!-- IP Address Needs to be changed first -->
<set token="tokSplunkVersion"></set>
</condition>
<condition>
<eval token="tokSplunkVersion">if(len(trim($value$))>0,$value$,"")</eval>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| inputlookup ipaddress_splunkversion.csv
| eval IPAddressOverridden="$tokIPAddress$",SplunkVersionOverridden="$tokSplunkVersion$"
| eval SplunkVersion=if(IPAddressOverridden=IPAddress AND len(SplunkVersionOverridden)>0,SplunkVersionOverridden,SplunkVersion), _time=if(IPAddressOverridden=IPAddress,now(),_time)
| table IPAddress SplunkVersion _time
| outputlookup ipaddress_splunkversion.csv append=f</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
