Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to use tokens from search in a lookup

$
0
0
So this might be overly complicated for what I'm trying to accomplish but perhaps you all might be able to assist me. Currently I am attempting to populate a dashboard panel with different searches based on a drop-down. The drop-down is using the Dynamic Options and searching from a lookup file(.csv) with the following field names: search_name | search In each of the rows in the search column, a specific query is displayed. The dropdown uses the search_name column as the value and creates a token named search_name_tk. On the dashboard, I am running a inputlookup and filtering on the search_name. |inputlookup search_lookup.csv |search search_name="$search_name_tk$" |stats values(search) AS "search" by search_name From there I set a token based on the results of the inputlookup search. $result.search$ Here is the full search |inputlookup search_lookup.csv |where search_name="$search_name_tk$" |stats values(search) AS "search" by search_name$result.search$No result found Using this I then place the $search_tk$ in the panel search. This seems to work and populates the searches from the lookup correctly, however, I am running into another issue where if there is token usage within the search in the lookup it does not seem to run properly. For example, if there is another drop-down for Computer Name on the dashboard which has computer_name_tk as the token. If said token is referenced in the search in the lookup it does not populate. I have a feeling there is a better way to get the result I am looking for. Dynamically populating multiple searches based on a drop-down but this is the best I have been able to come up with given my limited knowledge and the answers I have been able to find here. Any assistance you all can provide would be greatly appreciated!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>