Hi @MartyJ , it isn't so immediate, I developed a solution with JS and a solution without, this is the solution without: Obviously you can only modify a field in a lookup and not in an index, and u...
See more...
Hi @MartyJ , it isn't so immediate, I developed a solution with JS and a solution without, this is the solution without: Obviously you can only modify a field in a lookup and not in an index, and use a KV-Store: <form version="1.1">
<label>Manage All Cases</label>
<fieldset submitButton="false" autoRun="false">
<input type="radio" token="resetTokens" searchWhenChanged="true">
<label/>
<choice value="reset">Reset Inputs</choice>
<choice value="retain">Retain</choice>
<default>reset</default>
<change>
<condition value="reset">
<unset token="_key"/>
<unset token="timestamp"/>
<unset token="User_Name"/>
<unset token="Status"/>
<set token="resetTokens">retain</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<input type="dropdown" token="User_Name">
<label>User Name</label>
<choice value="*" OR NOT User_Name="*">All</choice>
<prefix>User_Name="</prefix>
<suffix>"</suffix>
<fieldForLabel>User_Name</fieldForLabel>
<fieldForValue>User_Name</fieldForValue>
<search>
<query>
| inputlookup open_cases
| dedup User_Name
| sort User_Name
| table User_Name
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>*" OR NOT User_Name="*</default>
</input>
<input type="dropdown" token="Status">
<label>Status</label>
<choice value="*">All</choice>
<prefix>Status="</prefix>
<suffix>"</suffix>
<fieldForLabel>Status</fieldForLabel>
<fieldForValue>Status</fieldForValue>
<search>
<query>
| inputlookup open_cases WHERE Status!="Escalation"
| dedup Status
| sort Status
| table Status
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>*</default>
</input>
<table id="master">
<title>Total All Cases = $server_count$</title>
<search>
<query>
| inputlookup my_lookup WHERE $User_Name$ $Status$
| eval Time=strftime(TimeStamp,"%d/%m/%Y %H:%M:%S"), key=_key
| table key Time Status User_Name TimeStamp
</query>
<sampleRatio>1</sampleRatio>
<progress>
<set token="server_count">$job.resultCount$</set>
</progress>
<cancelled>
<unset token="server_count"/>
</cancelled>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<fields>["_key","Time","Status","Notes","User_Name"]</fields>
<drilldown>
<set token="key">$row.key$</set>
<set token="timestamp">$row.TimeStamp$</set>
<set token="alertname">$row.Alert_Name$</set>
<set token="description">$row.Description$</set>
<set token="status">$row.Status$</set>
<set token="notes">$row.Notes$</set>
<set token="username">$row.User_Name$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<title>Modify Row</title>
<input type="dropdown" token="status_to_update">
<label>Status</label>
<default>$status$</default>
<search>
<query/>
</search>
<choice value="Closed">Closed</choice>
<choice value="Work-in-progress">Work-in-progress</choice>
<choice value="Escalation">Escalation</choice>
<choice value="Stand-By">Stand-By</choice>
</input>
<input type="text" token="notes_to_update">
<label>Add Notes</label>
<default>$notes$</default>
</input>
<table id="detail" depends="$key$">
<title>Row to modify</title>
<search>
<query>
| makeresults 1
| eval key="$key$", TimeStamp="$timestamp$", Status="$status_to_update$", Notes="$notes_to_update$", Time=strftime($timestamp$,"%d/%m/%Y %H:%M:%S")
| rename username AS User_Name | fields User_Name]
| table key Time TimeStamp Status Notes User_Name
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>_key,Time,Status,Notes,User_Name</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="status_updated">$row.Status$</set>
<set token="notes_updated">$row.Notes$</set>
<set token="username_updated">$row.User_Name$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<table id="detail2" depends="$status_to_update$">
<title>Modified Lookup row</title>
<search>
<query>
| inputlookup my_lookup
| eval
Status=if(_key="$key$","$status_updated$",Status),
Notes=if(_key="$key$","$notes_updated$",Notes),
User_Name=if(_key="$key$","$username_updated$",User_Name)
| search _key="$key$"
| outputlookup open_cases append=true
| eval key=_key
| collect addtime=true index=summary_alerts
| eval Time=strftime(TimeStamp,"%d/%m/%Y %H:%M:%S"), key=_key
| table key Time TimeStamp Alert_Name Description Status Notes User_Name
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>_key,Time,Status,Notes,User_Name</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form> Don't copy my dashboard but see the approach and adapt it to your real case. Ciao. Giuseppe