https://community.splunk.com/t5/Splunk-Search/How-to-insert-static-data-in-dashboard/m-p/90502#M23245 <P>Dart, thank you a lot! You showed me the right direction of solving the problem. Now I see vast horizons of how to use this new knowledge..:) I've already tried "inputlookup" and "lookup" and got exactly what I needed! </P> <P>I used splunk manager interface instead of editing config files to create lookup tables: <A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/User/CreateAndConfigureFieldLookups">http://docs.splunk.com/Documentation/Splunk/4.3.3/User/CreateAndConfigureFieldLookups</A></P> Wed, 04 Jul 2012 15:52:18 GMT iKate 2012-07-04T15:52:18Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-static-data-in-dashboard/m-p/90500#M23243 <P>Hello</P> <P>Let's say there are several Excel tables and it is needed to make graphs using its data in Splunk dashboard. How can one insert these tables?</P> Wed, 04 Jul 2012 08:48:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-static-data-in-dashboard/m-p/90500#M23243 iKate 2012-07-04T08:48:06Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-static-data-in-dashboard/m-p/90501#M23244 <P>If I understand correctly, you have data in an excel file, and you want to chart something just from that data in Splunk.</P> <P>Are you able to export the tables as CSV files?</P> <P>You can then define a <A href="http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_a_static_file">lookup from the csv file</A>, and then use the search command <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup">inputlookup</A> to read in the data, which you can then pipe to stats, chart or timechart. For example:</P> <PRE><CODE>| inputlookup my_lookup_name | chart count by field </CODE></PRE> Wed, 04 Jul 2012 10:10:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-static-data-in-dashboard/m-p/90501#M23244 dart 2012-07-04T10:10:50Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-static-data-in-dashboard/m-p/90502#M23245 <P>Dart, thank you a lot! You showed me the right direction of solving the problem. Now I see vast horizons of how to use this new knowledge..:) I've already tried "inputlookup" and "lookup" and got exactly what I needed! </P> <P>I used splunk manager interface instead of editing config files to create lookup tables: <A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/User/CreateAndConfigureFieldLookups">http://docs.splunk.com/Documentation/Splunk/4.3.3/User/CreateAndConfigureFieldLookups</A></P> Wed, 04 Jul 2012 15:52:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-static-data-in-dashboard/m-p/90502#M23245 iKate 2012-07-04T15:52:18Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-static-data-in-dashboard/m-p/90503#M23246 <P>Nevertheless it was a confusion with "inputlookup" command as it turned out that <BR /> 1) the command should be strictly in the beginning of the search<BR /> 2) should start with "|" <BR /> 3) and the rest of the search should be appended. <BR /> All this was not obvius from its description in the search commands reference (maybe just for me). </P> <P>So my working string looks like this:</P> <P>| inputlookup my_lookup_csv_file<BR /><BR /> | append [search source="my_source" <BR /> ...... ]</P> <P>Thanks again!</P> Mon, 28 Sep 2020 12:01:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-static-data-in-dashboard/m-p/90503#M23246 iKate 2020-09-28T12:01:32Z