topic Re: How to add lookup values as filter in dashboard and filter dashboard data in Dashboards & Visualizations

How to add lookup values as filter in dashboard and filter dashboard data

koreamit3483 — Thu, 09 Dec 2021 11:59:15 GMT

I have data receiving through forwarder which has SERVER_NAME with other details and i have another lookup created adding a csv file which holds data as SERVER_NAME, OWNER and REGION.

my current dashboard have a filter using SERVER_NAME coming from forwarder and now i need to create filter in dashboard of OWNER and REGION, which are from lookup and not from the data from forwarder.

I created the filter for OWNER and REGION and created tokens for them as "$owner_t$" and "$region_t$" which i am using in dashboard data as

| index = XXX OWNER="$owner_t$" and REGION="$region_t$"

when i select these tokens the data on dashboard is not getting filtered and shows as "No results found"

Can some one guide me where i am going wrong.

Re: How to add lookup values as filter in dashboard and filter dashboard data

gcusello — Thu, 09 Dec 2021 12:08:53 GMT

Hi @koreamit3483,

you have two ways:

to use these tokens after the lookup command,
create au automatic lookup.

In the first case, you have to create two dropdowns using the lookup:

| inputlookup your_lookup.csv | dedup OWNER | fields OWNER

and

| inputlookup your_lookup.csv | dedup REGION | fields REGION

then put in your search after the lookup command:

index = XXX | lookup your_lookup.csv SERVER_NAME OUTPUT OWNER REGION | search OWNER="$owner_t$" and REGION="$region_t$" | table ...

For the second way, you could follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.3/Knowledge/DefineanautomaticlookupinSplunkWeb

Ciao.

Giuseppe

Re: How to add lookup values as filter in dashboard and filter dashboard data

koreamit3483 — Thu, 09 Dec 2021 13:23:35 GMT

@gcusello

This is exactly what i was looking for and have resolved my query.

Thank you so much..