Dashboards & Visualizations

How to launch an action from dashboard

dreadangel
Path Finder

My splunk contains an index_main which collects events with next (simplified) format

id, status, description

A dashboard contains a dropdown, which loads via dedup status, and a table which loads the events filtered by dropdown's selected value.
The goal is, via dashboard, to copy the events from index_main to other indexes based on dropdown's value - as status fields admits (Info, Error, Critical) values, then data should be copied to index_info, index_error and index_critical indexes (indexes already exists) - I plan to use collect but I see no solution how to launch the script.

Any thoughts upon this kind of integration? Or I miss something?

Tags (3)
0 Karma
1 Solution

dreadangel
Path Finder
0 Karma

dreadangel
Path Finder

Actually, I found my answer here (https://answers.splunk.com/answers/600664/dashboard-button-to-run-spl-on-click.html). Thank you all for your assistance.

0 Karma

woodcock
Esteemed Legend

The collect command is not part of a script, it is SPL, so it is trivial. Just have a panel with something like this:

index="index_main" AND status=$dropdown_token$ | dedup status | addinfo | collect index=index_$dropdown_token$

adonio
Ultra Champion

what is the problem you are trying to solve?
seems like with your method every click / interaction with the dashboard should send results to summary index, is that what you are trying to achieve?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...