Dashboards & Visualizations

How to return to the main panel and update table after dropdown selection?

Italy1358
Path Finder

I have four panels: none, add, remove, reauthorize. When a user's information is added to the textbox and the add dropdown is selected it is written to a lookup table. If the remove is selected then that instance of that user is removed from the csv table. The none panel just displays the current table with the entries. I need to make it so that when add or remove is selected then it goes back to the none panel and shows the updated table.

<row>
<panel depends="$none">
<title>USb</title>
<table>
<search>
<query>
| inputlookup USB.csv
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$add$">
<title>Add User</title>
<table>
<search>
<query>| inputlookup USB.csv
| append [ | makeresults
| eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$"]
| eval keep_time=_time
| table _time, keep_time, user, category, department, description, revisit
| eval _time=keep_time
| outputlookup USB.csv</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<unset token="add"></unset>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$remove$">
<title>Remove User</title>
<table>
<search>
<query>| inputlookup USB.csv
| where user != "$user_tok$"
| eval keep_time=_time
| table _time, keep_time, user, category, description, revisit
| eval _time=keep_time
| outputlookup USB.csv
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<unset token="remove"></unset>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$reauthorize$">
<title>Reauthorize User</title>
<table>
<search>
<query>|inputlookup USB.csv</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>

Labels (2)
Tags (1)
0 Karma

etoombs
Path Finder

You should be able to do this using tokens. After the search to add a user completes , use the done event handler to unset the add token, and to set the none token again. Same on your other panels.

0 Karma

Italy1358
Path Finder

I did that but the none panel does not display the newly updated lookup table. I have to click on the refresh symbol to see the added results to the csv table.

@etoombs 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...