Splunk Search

How to modify a dashboard

AleCanzo
Path Finder

Hi, i'm searching for a way to modify my app/dashboard to be able to modify the entries of a table (such as delete/duplicate/copy/multiselect rows). Any suggestions? Maybe i have to look at the scripts from the lookup editor app? I really don't know where to start. I know how to write in python but i haven't created a script already. Thanks 🙂Dashboard viewDashboard viewScreenshot 2025-06-12 143826.png

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

AleCanzo
Path Finder

Thank you @bowesmana !

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...