Getting Data In

Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

potnuru
Path Finder

Example:

Splunk Dashboard: 

Panel 1--->

EMPID     NAME       TASK      COMMENTS

1              SANDEEP    A           Task A is Completed

2              xyz                 B            B is pending due to so and so reason.

3               yyy                C            _______________________

I want to build the Dashboard in a way that User should be able to give the COMMENTS for the selected row in Panel 1.

Then Next Time User runs the same Dashboard, User can see the already given comments corresponding to the row. Example 1 and 2 are already having comments.  3 is new row.

User should able to update the comments for 3 by clicking on the row.

is there any way to do it?

Labels (1)
Tags (1)

woodcock
Esteemed Legend

So potentially every user might have his own comment for every row?  Depending on users, that could really blow up in a big way.

You could look at how the ES app handles `investigations` using KV store.  You also need the `authentication` rest endpoint to get your users' login IDs.

potnuru
Path Finder

@woodcock 

So potentially every user might have his own comment for every row?

All the table data (for all Users) is fetched from an index except Comments field. 

Administrator will access the dashboard to view and to approve/reject each row item with comments.

So, Basically if the administrator is already approved/rejected a row, it should be shown in the dashboard so that he can take actions on other items.

 

0 Karma

potnuru
Path Finder

Hi @woodcock, Could you please help me on this?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can't edit the data ingested in Splunk, so you can't add additional field and save it to your raw data. 

What you might have to do would be to create a lookup table (preferably KV Store as it allows you to update one row) from your data and then run a query to save the lookup data with a new field "COMMENT" which gets it's value from a text box. As you can see it won't be an easy solution to develop. (You'll have to create a lookup with all key fields from your search result and field COMMENT. Then update your current panel search to show the field COMMENT using lookup command. Then create an in-page drilldown for selected rows and show a text box in that drill-down panel, and some way to run an outputlookup search to update the COMMENT field for that set of key fields in your KVSTore lookup).

potnuru
Path Finder

Hi @somesoni2 Thank you for sharing your idea.

I never used the KV Store lookup. I will explore on it.

Could you please check if you can help me on the below:

As explained in my main question, in Dashboard Panel 1 there are multiple rows. Each row has "COMMENTS" field. I want to display the text box only if the user clicks on any row/column.

Let's say user clicked on row 1 COMMENTS field, then I want to show test box to user so that he can input the data into it, when he clicked submit, I want to save the "Entered" data into COMMENTS field of row 1.

Is something we can do like this? 

potnuru
Path Finder

@rbal_splunk @kaurinko  @thambisetty @nick405060 

Hi Guys, Please help me on this.

0 Karma

kaurinko
Communicator

Hi,

Thanks for asking. Your problem looks interesting. Unfortunately I have never worked with anything like that, but on a rainy day I might experiment with some ideas. Right now I can't contribute, sorry.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...