Dashboards & Visualizations

Is it possible to make an app that can save information to an index that is input by a user?

fd26645
Path Finder

I made a dashboard that reports on backup success/failure.

Users are requesting the ability to add comments to the results or add a checkbox or something that indicates if a failure has been resolved.

To the best of my knowledge Splunk doesn't have the ability to write to the index after the fact. The data always stays in its original format once it has been indexed. So I need some suggestions on how to go about doing this. I would have to link the results of a search to an external database of some kind. I was thinking if I could somehow cause the dashboard interface to generate events that I would collect in another index and then correlate that to the original search results, that might work.

Any suggestions?

0 Karma
1 Solution

stephanefotso
Motivator

yes it is possible. With the collect command, you can ubdate your index.
Let suppose that you have an index called myindex which has certain events, with two fields ( field1, field2). And then you want your users to update myindex (add new events), with a custom field. Let say comments field. Here you go:

  1. You have a text box where a user can enter a comment.
  2. After a user entered his comment, you can update myindex by simply execute a query like this:

    index=myindex ....... |eval comments="$your_textbox_token$"|table field1 field2 comments|collect index=myindex marker="report=\"report1\"
    myindex will now has new events, with users comments, and you could be able to report on it.
    eg: index=myindex report="report1"|table field1 field2 comments

Thanks!
Stephane

View solution in original post

stephanefotso
Motivator

yes it is possible. With the collect command, you can ubdate your index.
Let suppose that you have an index called myindex which has certain events, with two fields ( field1, field2). And then you want your users to update myindex (add new events), with a custom field. Let say comments field. Here you go:

  1. You have a text box where a user can enter a comment.
  2. After a user entered his comment, you can update myindex by simply execute a query like this:

    index=myindex ....... |eval comments="$your_textbox_token$"|table field1 field2 comments|collect index=myindex marker="report=\"report1\"
    myindex will now has new events, with users comments, and you could be able to report on it.
    eg: index=myindex report="report1"|table field1 field2 comments

Thanks!
Stephane

fd26645
Path Finder

That is great! Thanks

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...