Question on Lookup and token usage

Deepz2612 — Mon, 08 Jul 2019 06:26:33 GMT

Hi,

I want a dashboard in which I have the Splunk queries in a lookup file like the below.

Application Name SubName First_Search            Second_Search
 XXX         Y    XY      index=<<search>>        index=<<search>>

According to the Application,Name and SubName Inputed,my dashboard panels(1 and 2) has to pickup the query from input file and execute it.

I'm able to write the below and bring them up in one panel,but I'm stuck how to use the token and how to pass them to pick the Second_Search query from lookup file and display the results in second panle.Kindly help me.

<row>
     <panel depends="$show_panel_unique_users$">
       <title>Total Vs Actual Users affected</title>
       <input type="dropdown" token="tokSearchQuery" searchWhenChanged="true">
         <label>Select the Api_Call</label>
         <fieldForLabel>SubName</fieldForLabel>
         <fieldForValue>Search</fieldForValue>
         <search>
           <query>| inputlookup trial.csv | where Name="$tokapi$" AND SubName="$api_call$" |table SubName Search</query>
         </search>
       </input>
       <input type="dropdown" token="tokSearchresponsecode" searchWhenChanged="true">
         <label>Select the Response_code</label>
         <fieldForLabel>response_code</fieldForLabel>
         <fieldForValue>response_code</fieldForValue>
         <search>
           <query>ABCYRT</query>
         </search>
       </input>
       <table>
         <title>Note : Click on the "Unique_Users_Count" to see all the Users affected</title>
         <search>
           <query>index=abc stats count</query>
           <earliest>$field1.earliest$</earliest>
           <latest>$field1.latest$</latest>
         </search>
         <option name="count">50</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
         <format type="color" field="response_code">
           <colorPalette type="sharedList"></colorPalette>
           <scale type="sharedCategory"></scale>
         </format>
         <drilldown>
           <condition field="Unique_Users_count">
             <set token="selected_Unique_Users_count">$click.value2$</set>
             <set token="show_panel_actual_users">true</set>
           </condition>
         </drilldown>
       </table>
     </panel>
   </row>

Re: Question on Lookup and token usage

woodcock — Mon, 08 Jul 2019 19:02:06 GMT

Like this:

| inputlookup trial.csv
| where Name="$tokapi$" AND SubName="$api_call$"
| map search="search $Search$ | eval SubName=$SubName$"

Re: Question on Lookup and token usage

woodcock — Fri, 25 Oct 2019 20:10:42 GMT

Did my solution work for you?

topic Question on Lookup and token usage in Dashboards & Visualizations

Question on Lookup and token usage

Re: Question on Lookup and token usage

Re: Question on Lookup and token usage