Splunk Search

How to modify a dashboard

AleCanzo
Explorer

Hi, i'm searching for a way to modify my app/dashboard to be able to modify the entries of a table (such as delete/duplicate/copy/multiselect rows). Any suggestions? Maybe i have to look at the scripts from the lookup editor app? I really don't know where to start. I know how to write in python but i haven't created a script already. Thanks 🙂Dashboard viewDashboard viewScreenshot 2025-06-12 143826.png

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

AleCanzo
Explorer

Thank you @bowesmana !

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...