Form Viz

Form Viz is a custom Splunk visualization for building interactive forms directly from SPL results or lookup-driven configuration. It solves the problem of collecting structured analyst input inside Splunk dashboards without building custom web pages or external apps. Form Viz can render text fields, dropdowns, radio buttons, checkboxes, dates, numbers, markdown guidance, and SPL review fields from simple rows containing question, type, options, order, and description values. Submitted responses are written to a Splunk KV Store collection with user, form name, question order, question text, answer, timestamp, and submission ID fields. This makes it useful for review workflows, triage forms, detection validation, saved search reviews, analyst notes, and other dashboard-based data collection tasks. The app includes example dashboards showing how to configure forms, use SPL display/input fields, and run a multi-section Saved Search Review workflow.