Dashboards & Visualizations

How to return to the main panel and update table after dropdown selection?

Italy1358
Path Finder

I have four panels: none, add, remove, reauthorize. When a user's information is added to the textbox and the add dropdown is selected it is written to a lookup table. If the remove is selected then that instance of that user is removed from the csv table. The none panel just displays the current table with the entries. I need to make it so that when add or remove is selected then it goes back to the none panel and shows the updated table.

<row>
<panel depends="$none">
<title>USb</title>
<table>
<search>
<query>
| inputlookup USB.csv
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$add$">
<title>Add User</title>
<table>
<search>
<query>| inputlookup USB.csv
| append [ | makeresults
| eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$"]
| eval keep_time=_time
| table _time, keep_time, user, category, department, description, revisit
| eval _time=keep_time
| outputlookup USB.csv</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<unset token="add"></unset>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$remove$">
<title>Remove User</title>
<table>
<search>
<query>| inputlookup USB.csv
| where user != "$user_tok$"
| eval keep_time=_time
| table _time, keep_time, user, category, description, revisit
| eval _time=keep_time
| outputlookup USB.csv
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<unset token="remove"></unset>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$reauthorize$">
<title>Reauthorize User</title>
<table>
<search>
<query>|inputlookup USB.csv</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>

Labels (2)
Tags (1)
0 Karma

etoombs
Path Finder

You should be able to do this using tokens. After the search to add a user completes , use the done event handler to unset the add token, and to set the none token again. Same on your other panels.

0 Karma

Italy1358
Path Finder

I did that but the none panel does not display the newly updated lookup table. I have to click on the refresh symbol to see the added results to the csv table.

@etoombs 

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...