topic Re: query help inputlookup map in Splunk Search

query help inputlookup map

surekhasplunk — Fri, 18 May 2018 10:45:56 GMT

| rest /services/authentication/users splunk_server=local 
| search 
    [| rest /services/authentication/current-context 
    | rename username as title 
    | fields title] 
| eval title=upper(title) 
| lookup employeeinfo.csv RACF_ID as title output EMPLOYEE_FULL_NAME 
| lookup rolesnames.csv "Delivery Manager" as EMPLOYEE_FULL_NAME output "Delivery Area" as area 
| where EMPLOYEE_FULL_NAME="abcd" 
| map 
    [| inputlookup EPerformanceData.csv 
    | search "Sub Division 6"="$area$" 
    | stats count  by "Sub Division 5" 
    | eval "% Completed"=((Completed/'Total to be Complete')*100) 
    | eval "% Completed"=round('% Completed',2) 
    | rename "Sub Division 5" as "Business Area"]

This patch of code works well. Now my requirement is i need to add once more inpulookupfile saying dates.csv which i need to use in this query like |inpulookup dates.csv |search Quarter=$quarter$ and here the $quarter$` values comes from the selected dropdown.

But where ever i try to include the above line of code either i get error or my previous tokens like area doesn't get the required value.
So please help me with thequery.

Thanks

Re: query help inputlookup map

ppatrikfr — Fri, 18 May 2018 11:45:33 GMT

Did you try to add token's value in an eval and try to call it on your new inputlookup by eval?

Re: query help inputlookup map

ppatrikfr — Fri, 18 May 2018 11:49:53 GMT

Re: query help inputlookup map

rlalwani_splunk — Fri, 18 May 2018 12:38:10 GMT

Try to use |inpulookup dates.csv where Quarter="$quarter$", might be the token value is set to empty and the replacement causes an syntax error in the query, so enclose the token value in double quotes.