Splunk Search

How to modify a dashboard

AleCanzo
Explorer

Hi, i'm searching for a way to modify my app/dashboard to be able to modify the entries of a table (such as delete/duplicate/copy/multiselect rows). Any suggestions? Maybe i have to look at the scripts from the lookup editor app? I really don't know where to start. I know how to write in python but i haven't created a script already. Thanks 🙂Dashboard viewDashboard viewScreenshot 2025-06-12 143826.png

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

AleCanzo
Explorer

Thank you @bowesmana !

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...