https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-dashboard-search-textfield-working-with-lookup-values/m-p/499797#M32718 <P>You are taking an input record, then using the input field <CODE>license_hash</CODE> to look that up and get <CODE>customer_id</CODE> and <CODE>customer_name</CODE></P> <P>It looks like you then intend to use command <CODE>iplocation</CODE> to look up the location info from the field <CODE>client_ip</CODE>. however, at that point you don't appear to actually have a field named <CODE>client_ip</CODE>. Is that in the initial event record, or is it in the lookup table, or is it nowhere? </P> Mon, 03 Feb 2020 18:11:13 GMT DalJeanis 2020-02-03T18:11:13Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-dashboard-search-textfield-working-with-lookup-values/m-p/499796#M32717 <P>I have a table in my dashboard:<BR /> my search********* </P> <PRE><CODE>"$search_field$" |lookup customer.csv license_hash as license_hash OUTPUT customer_id customer_name |ip location client_ip |table customer_id,customer_name,client_ip....... </CODE></PRE> <P>In the dashboard I have a search field and on the table a drill down on this search field.</P> <P>The problem: w<BR /> When I click on values of customer_id,client_ip, City,_Customer_name..... <BR /> I get no results....of course not because of the lookup after the search field in the search.</P> <P>Wich changes I have to do to make it possible to search with this values?</P> <P>to add <CODE>|search "§search_field§"</CODE> after the lookup doesn't work.</P> Wed, 30 Sep 2020 03:58:53 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-dashboard-search-textfield-working-with-lookup-values/m-p/499796#M32717 david1395 2020-09-30T03:58:53Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-dashboard-search-textfield-working-with-lookup-values/m-p/499797#M32718 <P>You are taking an input record, then using the input field <CODE>license_hash</CODE> to look that up and get <CODE>customer_id</CODE> and <CODE>customer_name</CODE></P> <P>It looks like you then intend to use command <CODE>iplocation</CODE> to look up the location info from the field <CODE>client_ip</CODE>. however, at that point you don't appear to actually have a field named <CODE>client_ip</CODE>. Is that in the initial event record, or is it in the lookup table, or is it nowhere? </P> Mon, 03 Feb 2020 18:11:13 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-dashboard-search-textfield-working-with-lookup-values/m-p/499797#M32718 DalJeanis 2020-02-03T18:11:13Z