topic Search results to lookup table in Splunk Search

Search results to lookup table

mwdbhyat — Thu, 08 Sep 2016 09:20:47 GMT

Hi,

I am currently running a search in a custom app that finds sourcetypes by number of hosts:
- | tstats dc(host) as "Number of Hosts" where index=test* by sourcetype

Id like to know how to:
- Convert the results to a lookup table
- Edit the lookup table when required in the UI - Would I be able to use the lookup app within my custom app?

Thanks!

Re: Search results to lookup table

renjith_nair — Thu, 08 Sep 2016 09:35:17 GMT

You can use outputlookup to store and modify data

See here : http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Outputlookup

Re: Search results to lookup table

mwdbhyat — Thu, 08 Sep 2016 09:54:11 GMT

Thanks - I should probably have mentioned that I need this information to display in the table on the dashboard where my search results currently get displayed.. So im guessing ill just set up a saved search to output the file to csv and update it daily, then on the dashboard use an inputlookup search to display the results..

My next task is to the somehow create a way to manually edit the lookup on the dashboard when required..I know there is a lookup app, any thoughts on how I could integrate this into my dashboard within my app?

Re: Search results to lookup table

renjith_nair — Thu, 08 Sep 2016 10:10:21 GMT

If you want to use another app, you need to create a link to the other app(even drill down works) from your dashboard or merge the artifacts of the apps.

Alternatively , you can KVstore lookup and create your own dashboards to edit or amend. Please see this example with all operations on a KVStore : http://dev.splunk.com/view/webframework-tutorials/SP-CAAAEZT