Hello,
Could I get some advice to get the right solution to my problem, I am a Splunk newbie and my knowledge of proper search syntax is garbage, so here it goes:
I have a dashboard application where I have a table and two columns of this table can be filled by the user, this operation can be made after a search.
My question is, Which could be the best option to updated the empty fields before the search to the new value that the user filled on the table? How Could I atteched this value to the event of the search? I was reading about the lookup method but I don't understand it, and also searching about modify fields of an event but I didn't get a good answer.
Someone could help me a little?
Also Attached an image of my dashboard to explain me a little better
Thanks in advanced
Rosana
