topic Is it possible to set a token using a field found in a lookup without drilldown? in Splunk Search

Is it possible to set a token using a field found in a lookup without drilldown?

jamesmarlowww — Tue, 17 Nov 2015 01:52:20 GMT

Can I set a token using a field found in a lookup table? I've been researching online, but I haven't found a real solution. Thanks in advanced for any help

Re: Is it possible to set a token using a field found in a lookup without drilldown?

sundareshr — Tue, 17 Nov 2015 03:04:56 GMT

Yes you can. The online documentation has a few examples showing use of token for things other than drill-down. There's one on dynamic display of elements. What specifically are you looking for?

http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/tokens

Re: Is it possible to set a token using a field found in a lookup without drilldown?

jamesmarlowww — Tue, 17 Nov 2015 03:28:05 GMT

Thanks that's helpful. I was looking to set the outputed ID to the token $ID$

    <title>Lookup customer</title>
    <searchString>index = foo | head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT ID</searchString>

Re: Is it possible to set a token using a field found in a lookup without drilldown?

sundareshr — Tue, 17 Nov 2015 04:03:29 GMT

Do you not see the value of the token pass in?

Re: Is it possible to set a token using a field found in a lookup without drilldown?

jamesmarlowww — Tue, 17 Nov 2015 23:02:25 GMT

Yes I can see the value. But I don't know how to pass a value to a token inside a search.

I've tried to implement your example like this, but it isn't working.

    <searchString>index = foo| head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT  ID ect ect ect | rename ect as "blah"| transpose</searchString>
    <earliestTime>-60m@m</earliestTime>
    <latestTime>now</latestTime>
    <progress>
      <condition match="'job.resultCount' ==*">
        <set token="ID">$row.ID$</set>
      </condition>
      <condition match="'job.resultCount' !=*">
        <set token="ID">$row.ID$</set>
      </condition>
      <change>
         <set token="ID">$row.ID$</set>
      </change>
   </progress>

Re: Is it possible to set a token using a field found in a lookup without drilldown?

jamesmarlowww — Wed, 18 Nov 2015 22:39:32 GMT

I've come to the conclusin that this isn't possbile in my version of splunk (6.1). I think it's possible in 6.2 or later. You need to put the progress or change options inside search and query objects like in by sundareshr's answer

Re: Is it possible to set a token using a field found in a lookup without drilldown?

nfilippi_splunk — Wed, 18 Nov 2015 23:18:44 GMT

Just to clarify, there are a few things that will not work in the above xml code:

searchString/earliestTime/latestTime is legacy syntax for search
is a new event handler introduced in Splunk 6.3
event handler is only supported within form inputs
is only available for drilldown

So based on the above, here's what it should really look like:

<search>

   <query>index = foo| head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT  ID ect ect ect | rename ect as "blah"| transpose</query>
   <earliest>-60m@m</earliest>
   <latest>now</latest>

   <progress> 
      <set token="ID">$result.ID$</set>
   </progress>

<search>