topic Re: How to use outputlookup and inputlookup in same dashboard in same query in Splunk Enterprise

How to use outputlookup and inputlookup in same dashboard in same query

Keerthana_18 — Tue, 26 Oct 2021 10:35:45 GMT

Hello Everyone,

I am in situation where in I will send the results to one lookup file and from there again I need to take tail 2 two rows to display as a summary in my Dashboard. Below is the exact scenario.

I have a search which compares last week and this week data and produces the results something like below.

Date	Active	Inactive	Deleted	Added
10/25/2021	80	20	10	15

I need to send the results calculated in above search to one lookup file . Like that I will keep on sending every week. It will be like below after some weeks say 3 weeks.

Date	Active	Inactive	Deleted	Added
10/25/2021	80	20	10	15
11/1/2021	78	22	8	11
11/8/2021	83	18	9	6

so above is the lookup file, then I need to use the the created lookup as input in the same query to perform some calculations (i.e,. I need to take tail 2 and display it as summary of last 2 weeks).

Tried something like below. But it didn't worked. Could someone help me on this.

<search > | outputlookup test1.csv | search inputlookup test1.csv | tail 2

Re: How to use outputlookup and inputlookup in same dashboard in same query

PickleRick — Tue, 26 Oct 2021 11:40:50 GMT

Firstly, I wouldn't do it this way - keep the long-term state in a lookup file. In case you have any mistake in your processing, you lose your history. So overwriting blindly your only copy of calculated stats is a bad idea.

Anyway, I did a simple test - reading from a lookup, modifying the value(s) and writing it back seems to work ok.

| inputlookup test.csv | eval field=field+1 | outputlookup test.csv

Repetitive searches like that cause the field value to increase.

I assume that in your case you'd need something like

| inputlokup whatever | append [ your search generating results ] | outputlookup whatever

Keep in mind though that each run of such search would append your lookup contents in this form so you'd have to implement some fancy logic to check whether to add whole next row or just update one of the results and so on. There's no good reason to complicate things that much. I'd just stick to calculating results on the fly and accelerate the report if needed.

Re: How to use outputlookup and inputlookup in same dashboard in same query

PickleRick — Tue, 26 Oct 2021 13:23:52 GMT

OK. It seems more complicated because the test did work (albeit run on a small all-in-one environment) but I wanted to do a one-off modification of a saved lookup and it seems doing an inputlookup then adding some column and saving the lookup file back didn't work. Strange.

It must have something to do whether I run it on all-in-one or on search head cluster, because it's repeatable - on aio it does work - modifying values, adding columns and so on. On SHC it seems to be not working.