Splunk Search

Add manual input through text box into a new column in a table splunk

nikitha15
Explorer

Hi ,

I want to add a text box in a dashboard panel and the manual input value of that textbox should be added to a new column in an already existing table.

I understand that this can be done by lookup to save the values but i am not sure how to go ahead with it.

This is the data format of the table i have with sample data(the original data i have is confidential).

EMAILNAMEIPID(new column)
nish123@gmail.comNishanth10.10.10.0 
abc098@gmail.comABC224.0.0.0 
amit187@gmail.comAmit Sharma63.125.0.0 

  

I want to add a text box to this panel whose values should be inputted into ID column based on the unique value of EMAIL.

and i want to save this table with the new values of ID. 

How can this be done?? Any help would be appreciated.thanks

Labels (3)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The way I have done something similar is possibly over-elaborate but I started with a lookup, as you mentioned, then populate the Id column from this lookup. In order to update the lookup, I have another panel where the key (email in this case) and new ID value can be added - I added checkbox to this for the use to confirm that the update was correct. Then on change for the checkbox, set tokens for a third panel to use to actually update the lookup with outputlookup. This third panel is hidden using the depends attribute. The third panel also resets the checkbox in the second panel so I can detect a new update, and it sets a token used in the first panel so that the panel gets refreshed. I have some other pieces set up so only certain users can update the lookup although to be fair these could be overridden reasonably easily if someone was determined enough.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...