topic Lookup Table as input for Dashboard in Splunk Search

Lookup Table as input for Dashboard

MarieHe — Tue, 17 Aug 2021 12:51:50 GMT

Hello,

I would like to enter the info from a lookup table into my dashboard search.

lookup table name: FIP.csv

content:

field1;field2

160;43

180;50

I tried this:

| inputlookup FIP.csv

and then several add-ons like

| lookup FIP field1 OUTPUTNEW field2

but nothing works.

What is the correct syntax?

ITWhisperer — Tue, 17 Aug 2021 12:55:15 GMT

Have you added it to the list of lookups?

MarieHe — Tue, 17 Aug 2021 13:00:32 GMT

Yes. And I can see it in "Datasets", too.

| inputlookup "NRCS2AUDI_FIP_Lookup_SOLL.csv"

is working but I cannot devide the two different columns with ; into two separate types

ITWhisperer — Tue, 17 Aug 2021 14:12:49 GMT

| eval field1=mvindex(split('field1;field2',";"),0) | eval field2=mvindex(split('field1;field2',";"),1)