Splunk Search

How to modify a dashboard

AleCanzo
Path Finder

Hi, i'm searching for a way to modify my app/dashboard to be able to modify the entries of a table (such as delete/duplicate/copy/multiselect rows). Any suggestions? Maybe i have to look at the scripts from the lookup editor app? I really don't know where to start. I know how to write in python but i haven't created a script already. Thanks 🙂Dashboard viewDashboard viewScreenshot 2025-06-12 143826.png

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You can write dashboards to "edit" lookup tables, but it involves the use of inputlookup and outputlookup to update/add/delete items from the lookup. It's a bit involved but involves setting and clearing tokens that allow the searches to run and using some kind of key to identify each row of the table for updates and deletes.

Typically add would

| inputlookup your_table.csv
| append [
  | makeresults
  | eval ... set your fields here from dashboard token form inputs
]
| outputlookup your_table.csv

Update would

| inputlookup your_table.csv
| eval field1=if(this_row=row_to_update, new_field1, old_field1)
... for each field
| outputlookup your_table.csv

and delete would

| inputlookup your_table.csv
| where event!=event_to_delete
| outputlookup your_table.csv

 We use a small piece of JS to implement buttons for the "commit" part of the form input. It's a bit of a fiddly dashboard, but it's possible - we use it a lot.

 

AleCanzo
Path Finder

Thank you @bowesmana !

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...