Dashboards & Visualizations

How to return to the main panel and update table after dropdown selection?

Italy1358
Path Finder

I have four panels: none, add, remove, reauthorize. When a user's information is added to the textbox and the add dropdown is selected it is written to a lookup table. If the remove is selected then that instance of that user is removed from the csv table. The none panel just displays the current table with the entries. I need to make it so that when add or remove is selected then it goes back to the none panel and shows the updated table.

<row>
<panel depends="$none">
<title>USb</title>
<table>
<search>
<query>
| inputlookup USB.csv
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$add$">
<title>Add User</title>
<table>
<search>
<query>| inputlookup USB.csv
| append [ | makeresults
| eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$"]
| eval keep_time=_time
| table _time, keep_time, user, category, department, description, revisit
| eval _time=keep_time
| outputlookup USB.csv</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<unset token="add"></unset>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$remove$">
<title>Remove User</title>
<table>
<search>
<query>| inputlookup USB.csv
| where user != "$user_tok$"
| eval keep_time=_time
| table _time, keep_time, user, category, description, revisit
| eval _time=keep_time
| outputlookup USB.csv
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<unset token="remove"></unset>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$reauthorize$">
<title>Reauthorize User</title>
<table>
<search>
<query>|inputlookup USB.csv</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>

Labels (2)
Tags (1)
0 Karma

etoombs
Path Finder

You should be able to do this using tokens. After the search to add a user completes , use the done event handler to unset the add token, and to set the none token again. Same on your other panels.

0 Karma

Italy1358
Path Finder

I did that but the none panel does not display the newly updated lookup table. I have to click on the refresh symbol to see the added results to the csv table.

@etoombs 

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...