https://community.splunk.com/t5/Monitoring-Splunk/inputlookup-searches/m-p/387392#M6456 <P>How about having a dashboard with 'drop-down' showing the list of possible application names ? . something like below where you can populate the values and setup default/initial values etc.. The application selected by user is then available in the "appname" token.</P> <P>..<BR /> ..</P> <P>|inputlookup xyz | stats count by application | table application</P> <P>//using value from token<BR /> You can then use the value captured in token to select required application/index/sourcetype from the lookup<BR /> |inputlookup xyz | search APPLICATION=$appname$ </P> <P>Pls also refer to:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens">https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens</A> </P> Tue, 08 Jan 2019 11:54:34 GMT lakshman239 2019-01-08T11:54:34Z https://community.splunk.com/t5/Monitoring-Splunk/inputlookup-searches/m-p/387390#M6454 <P>How to use a inputlook to run several different indexes depending on which option the user selects on the drop down and then using the lookup to collate the different fields into one field which stops having to rewrite a query.</P> Mon, 07 Jan 2019 16:58:39 GMT https://community.splunk.com/t5/Monitoring-Splunk/inputlookup-searches/m-p/387390#M6454 Eshaac 2019-01-07T16:58:39Z https://community.splunk.com/t5/Monitoring-Splunk/inputlookup-searches/m-p/387391#M6455 <P>This doesn't make sense.. You should include some examples of what your expecting</P> <P>Also, why use <CODE>inputlookup</CODE> over <CODE>lookup</CODE>? Why use <CODE>lookup</CODE> over <CODE>coalesce</CODE>?</P> Mon, 07 Jan 2019 18:11:29 GMT https://community.splunk.com/t5/Monitoring-Splunk/inputlookup-searches/m-p/387391#M6455 skoelpin 2019-01-07T18:11:29Z https://community.splunk.com/t5/Monitoring-Splunk/inputlookup-searches/m-p/387392#M6456 <P>How about having a dashboard with 'drop-down' showing the list of possible application names ? . something like below where you can populate the values and setup default/initial values etc.. The application selected by user is then available in the "appname" token.</P> <P>..<BR /> ..</P> <P>|inputlookup xyz | stats count by application | table application</P> <P>//using value from token<BR /> You can then use the value captured in token to select required application/index/sourcetype from the lookup<BR /> |inputlookup xyz | search APPLICATION=$appname$ </P> <P>Pls also refer to:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens">https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens</A> </P> Tue, 08 Jan 2019 11:54:34 GMT https://community.splunk.com/t5/Monitoring-Splunk/inputlookup-searches/m-p/387392#M6456 lakshman239 2019-01-08T11:54:34Z