topic Re: Search field with inputlookup in Dashboards & Visualizations

How to search field with inputlookup?

POR160893 — Thu, 26 May 2022 16:41:45 GMT

Hi,

I am creating a dashboard where the data is provided via CSV. So, I am using the inputlookup command.

However, I need to search on one specific field (or column) on the CSV and I am currently using this but it is not working:

| inputlookup ABC | search Device Name = "sdf"

Can you please help?

Re: Search field with inputlookup

POR160893 — Thu, 26 May 2022 09:52:18 GMT

I think the issue is the field name is composed of 2 words "Device Name" and I am not sure how to search with this ...

Re: Search field with inputlookup

ITWhisperer — Thu, 26 May 2022 10:09:48 GMT

Will where work better for you?

| inputlookup ABC | where 'Device Name' = "sdf"

Note that the field name needs to be in single quotes if it has embedded spaces or other special characters

Re: Search field with inputlookup

POR160893 — Thu, 26 May 2022 10:12:57 GMT

No quiet 😞

Re: Search field with inputlookup

ITWhisperer — Thu, 26 May 2022 10:35:00 GMT

The where command will use a case-sensitive comparison whereas search uses case-insensitive comparisons. Is this perhaps the issue?

Re: Search field with inputlookup

POR160893 — Thu, 26 May 2022 10:39:57 GMT

What did I do incorrectly? The field name is "Device Name".

Re: Search field with inputlookup

ITWhisperer — Thu, 26 May 2022 10:44:11 GMT

What about if you just search for buemwgproxy02 without the field name

| search "buemwgproxy02"

Re: Search field with inputlookup

POR160893 — Thu, 26 May 2022 10:57:10 GMT

No luck 😣

Re: Search field with inputlookup

ITWhisperer — Thu, 26 May 2022 11:07:03 GMT

| where match('Device Name',"buemwgproxy02")

Re: Search field with inputlookup

POR160893 — Thu, 26 May 2022 11:10:33 GMT

Thank you 😀

Re: Search field with inputlookup

POR160893 — Thu, 26 May 2022 15:11:55 GMT

Hey,

So, I was just asked to further update this dashboard so that the default values of the panels show ALL values of the lookup tables.

The tricky bit is incoporating that requets into the current query which is as follows:
<panel>
<title>McAfee</title>
<table>
<search>
<query>
| inputlookup Migration-Status-McAfee
| where match('Device Name',"$mcafee_tok$")</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
</table>
</panel>

However, when I search for all, it fails:

Can you please help?

Thanks so much!

Re: Search field with inputlookup

POR160893 — Thu, 26 May 2022 15:13:53 GMT

Hey,

Can you please help?

Thanks so much!

Re: Search field with inputlookup

ITWhisperer — Thu, 26 May 2022 17:36:23 GMT

Make the all value ".*" instead of just "*" - if necessary, if you are using that token elsewhere successfully, you may need to eval a new token to cater for this case.

Re: Search field with inputlookup

POR160893 — Fri, 27 May 2022 08:37:03 GMT

This was perfect!
Thanks a million and learned something new here too!