Dashboards & Visualizations

How to launch an action from dashboard

Path Finder

My splunk contains an index_main which collects events with next (simplified) format

id, status, description

A dashboard contains a dropdown, which loads via dedup status, and a table which loads the events filtered by dropdown's selected value.
The goal is, via dashboard, to copy the events from index_main to other indexes based on dropdown's value - as status fields admits (Info, Error, Critical) values, then data should be copied to index_info, index_error and index_critical indexes (indexes already exists) - I plan to use collect but I see no solution how to launch the script.

Any thoughts upon this kind of integration? Or I miss something?

Tags (3)
0 Karma
1 Solution

Path Finder
0 Karma

Path Finder

Actually, I found my answer here (https://answers.splunk.com/answers/600664/dashboard-button-to-run-spl-on-click.html). Thank you all for your assistance.

0 Karma

Esteemed Legend

The collect command is not part of a script, it is SPL, so it is trivial. Just have a panel with something like this:

index="index_main" AND status=$dropdown_token$ | dedup status | addinfo | collect index=index_$dropdown_token$

Ultra Champion

what is the problem you are trying to solve?
seems like with your method every click / interaction with the dashboard should send results to summary index, is that what you are trying to achieve?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...