Splunk Dashboard to accept Input Data from the User and Save it in the Dashboard - For Each Row in Dashboard

[potnuru]

Example:

Splunk Dashboard: 

Panel 1--->

EMPID     NAME       TASK      COMMENTS

1              SANDEEP    A           Task A is Completed

2              xyz                 B            B is pending due to so and so reason.

3               yyy                C            _______________________

I want to build the Dashboard in a way that User should be able to give the COMMENTS for the selected row in Panel 1.

Then Next Time User runs the same Dashboard, User can see the already given comments corresponding to the row. Example 1 and 2 are already having comments.  3 is new row.

User should able to update the comments for 3 by clicking on the row.

is there any way to do it?

[woodcock]

So potentially every user might have his own comment for every row?  Depending on users, that could really blow up in a big way.

You could look at how the ES app handles `investigations` using KV store.  You also need the `authentication` rest endpoint to get your users' login IDs.

[potnuru]

@woodcock 

So potentially every user might have his own comment for every row?

All the table data (for all Users) is fetched from an index except Comments field. 

Administrator will access the dashboard to view and to approve/reject each row item with comments.

So, Basically if the administrator is already approved/rejected a row, it should be shown in the dashboard so that he can take actions on other items.

[potnuru]

Hi @woodcock, Could you please help me on this?

[somesoni2]

You can't edit the data ingested in Splunk, so you can't add additional field and save it to your raw data. 

What you might have to do would be to create a lookup table (preferably KV Store as it allows you to update one row) from your data and then run a query to save the lookup data with a new field "COMMENT" which gets it's value from a text box. As you can see it won't be an easy solution to develop. (You'll have to create a lookup with all key fields from your search result and field COMMENT. Then update your current panel search to show the field COMMENT using lookup command. Then create an in-page drilldown for selected rows and show a text box in that drill-down panel, and some way to run an outputlookup search to update the COMMENT field for that set of key fields in your KVSTore lookup).

[potnuru]

Hi @somesoni2 Thank you for sharing your idea.

I never used the KV Store lookup. I will explore on it.

Could you please check if you can help me on the below:

As explained in my main question, in Dashboard Panel 1 there are multiple rows. Each row has "COMMENTS" field. I want to display the text box only if the user clicks on any row/column.

Let's say user clicked on row 1 COMMENTS field, then I want to show test box to user so that he can input the data into it, when he clicked submit, I want to save the "Entered" data into COMMENTS field of row 1.

Is something we can do like this? 

[potnuru]

@rbal_splunk @kaurinko  @thambisetty @nick405060 

Hi Guys, Please help me on this.

[kaurinko]

Hi,

Thanks for asking. Your problem looks interesting. Unfortunately I have never worked with anything like that, but on a rainy day I might experiment with some ideas. Right now I can't contribute, sorry.