Splunk Search

How to modify a dashboard

AleCanzo
Explorer

Hi, i'm searching for a way to modify my app/dashboard to be able to modify the entries of a table (such as delete/duplicate/copy/multiselect rows). Any suggestions? Maybe i have to look at the scripts from the lookup editor app? I really don't know where to start. I know how to write in python but i haven't created a script already. Thanks 🙂Dashboard viewDashboard viewScreenshot 2025-06-12 143826.png

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

AleCanzo
Explorer

Thank you @bowesmana !

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...