topic Re: Why is outputlookup not working in dashboard? in Installation

Why is outputlookup not working in dashboard?

johnjester — Thu, 06 Oct 2022 23:49:54 GMT

I initialize a lookup file using:

| makeresults | outputlookup status.csv

I then have this simple search:

| inputlookup status.csv | eval a=if(isnull(a),1,a+1) | outputlookup status.csv

This works fine when I run it in Search. The "a" value gets incremented each time the search is executed.

But if I put the same thing in a dashboard it results in an error and does not update the lookup table.

In a classic dashboard, the panel with this search just says "Search was cancelled".

In dashboard studio, a panel with this search as its data source reports this error: "Unexpected non-whitespace character after JSON at position 4"

Removing the outputlookup command in either case makes the search work, and it shows an up-to-date value for "a" (given how many times the search was executed in Search).

I have no clue what I'm doing wrong with what seems like such a simple thing - really hoping someone can help me!

Re: Why is outputlookup not working in dashboard?

gcusello — Fri, 07 Oct 2022 06:31:43 GMT

Hi @johnjester,

I used outputlookup in a Classic dashboard and it runs without errors.

The only issue is that the lookup is updated at every dashboard reload.

I didn't tried with Dashboard Studio, but it should be the same thing.

Maybe there something else.

Ciao.

Giuseppe

Re: Why is outputlookup not working in dashboard?

ITWhisperer — Fri, 07 Oct 2022 06:46:23 GMT

Are you running a multi-search-head environment?

I have found that updates to csv are not instantaneous, so is there perhaps a lag between the outputlookup and inputlookup?

Re: Why is outputlookup not working in dashboard?

johnjester — Mon, 26 Jan 2026 19:20:03 GMT

I had the same problem in 2026, and happened upon this post again. This time I have the solution!

To this file (create if needed):

<splunk home>/etc/apps/<app name>/default/commands.conf

Add this section:

[outputlookup]
is_risky = false

Re: Why is outputlookup not working in dashboard?

gcusello — Tue, 27 Jan 2026 07:47:14 GMT

Hi @johnjester ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉