topic Re: Help required regarding lookup in Splunk Search

Help required regarding lookup

deepusoundar — Mon, 25 Feb 2019 16:57:33 GMT

I have a lookup(search_query.csv) with data as below.

Name Subcategory Query
Get      Vehicle          index=abc I where api=fig I table api msg
Post    Summary      index=cfg I where api=his I table api msg

[Note : lookup has 1000's row data such as above]

Now I would want to run a query using the above lookup,when name and subcategory matches,it has to execute the corresponding query. (i.e., use Name and Subcategory as input and get the query as output and use the output query as the search).

Is it possible?????

Re: Help required regarding lookup

lakshman239 — Mon, 25 Feb 2019 17:46:37 GMT

Are you trying to use this in dashboard?

|makeresults | eval Name="Get", Subcategory="Vehicle" | inputlookup search_query.csv Name Subcategory OUTPUT Query

the above will return your search (Query).

Re: Help required regarding lookup

deepusoundar — Mon, 25 Feb 2019 18:21:45 GMT

Yes,am tryinh to use this for dashboard only..

I just do not want to get the query as result instead i would want to execute the query and see the result of that query..

For example,
For an event matching Name and subcategory,it has to fetch the query from lookup and execute that search and show the result..

Re: Help required regarding lookup

somesoni2 — Mon, 25 Feb 2019 19:05:51 GMT

How are you planning to execute the query and how are you selecting/providing those Name/Subcategory field values? Are they going to come from a dropdown or something?

Re: Help required regarding lookup

cvssravan — Tue, 29 Sep 2020 23:25:44 GMT

To my knowledge, you cannot pass the whole query from the output of lookup for a search.
But if you have query with fixed variables as you mentioned in the sample and constant query, you can try something like this:
index=abc I where api=fig I table api msg
Split the fields from the query into individual fields
ex: index_from_lookup=abc , api_from_lookup=fig, so you lookup looks like this

Name Subcategory index_from_lookup api_from_lookup
Get Vehicle abc fig
Post Summary cfg his

and then pass them to map command after the lookup. Sample is shown below. I have used "where" instead of "lookup command" for sample as I don't have the csv to do lookup

If you have limited searches in lookup and if you can create macros for each search, you can try this after you have the macro name from output of lookup
| map search="search $macro_name_from_lookup_output$ " (This will not be an option for you if you have 1000 different queries in your lookup).

Hope it helps.

Re: Help required regarding lookup

deepusoundar — Mon, 25 Feb 2019 21:25:30 GMT

The name and subcategory as they come in the event,when they get matched,they are used as input of lookup and query as the output and that query has to be executed

Re: Help required regarding lookup

lakshman239 — Tue, 26 Feb 2019 09:46:16 GMT

You cannot do that in the search pipeline to my knowledge. you may be able to achieve that in a dashboard, but having a search which matches Name and subcategory as input against your events returning the Query. And when user clicks it, you can show/run the search to return results in another window/panel in the dashboard [ drill-down search]

Re: Help required regarding lookup

deepusoundar — Tue, 26 Feb 2019 10:01:44 GMT

Can yu help me on how to proceed with it

Re: Help required regarding lookup

lakshman239 — Tue, 26 Feb 2019 11:33:30 GMT

pls download the https://splunkbase.splunk.com/app/1603/ app and install on your dev instance and you can look for 'Drilldown Elements' and it has samples in Drilldown Link Dashboard. A few others can also help you.

You can your base search which is something like index=* | inputlookup search_query.csv Name subcategory OUTPUT query .. this will show results in the first dashboard panel. When users click any row, you can then use token [ will have contents of query] and pass it to drill-down search to run that and return results in another panel within the same dashboard.

Re: Help required regarding lookup

lakshman239 — Tue, 26 Feb 2019 17:33:14 GMT

if you are happy with the solution, pls accept to close the thread.