Lookup works in search but not in searchTemplate

[colinj]

Howdy all,

I'm working with the Splunk for VMware app and I'm having trouble with a lookup. The following search works just fine as a plain search

index=vmware source="VirtualMachinePerf" SumRdy_ms="*" perftype="cpu" moname="m-mssqlprd017" 
| lookup TimeHierarchyVMSummary moname AS moname
| eval SumRdyPerCpu_ms=(SumRdy_ms / numCpu) 
| timechart max(SumRdy_ms) AS "Sum Ready Time" max(SumRdyPerCpu_ms) AS "Actual Time Spent" 

However when I try and use it in a searchTemplate for a form

 index=vmware source="VirtualMachinePerf" SumRdy_ms="*" perftype="cpu" moname=$hostname$
 | lookup TimeHierarchyVMSummary moname
 | eval SumRdyPerCpu_ms=(SumRdy_ms / numCpu)
 | timechart max(SumRdy_ms) AS "Sum Ready Time" max(SumRdyPerCpu_ms) AS "Actual Time Spent"

I get the following error:

PARSER: Applying intentions failed Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

Other than the use of a variable in the search when using it in the form everything is the same. If I remove the lookup then it all works just fine but I need the lookup so I can get the 'numCpu' value. Do I need to format the lookup differently when it is used in a searchTemplate?

[colinj · Accepted solution]

Nerd, heal thyself.

So what was going wrong here was the same thing that my mechanic says goes wrong with my car, it was the nut that holds the steering wheel.

What I hadn't taken in to account is the caching that a browser does with a web page. So although I was changing the XML for the page I was not updating that when I viewed the page. Once I realized what I was doing it all worked fine.

So, always make sure that you aren't caching the page you are trying to look at if you are making changes.

Here endeth the lesson.

[linu1988]

Did you check your lookup definition? Does this moname field exists in the lookup table? if not you have to specify the field in the lookup table as moname. It's most probably the problem with lookup definition. Tweak a bit it will work.

[colinj]

$hostname$ is getting passed from a drop down selection earlier in the form. If I remove the lookup and eval lines from the search it works just fine.

  <input type="dropdown" token="hostname" searchWhenChanged="true">
      <label>Host:</label>
      <populatingSearch fieldForValue="moname" fieldForLabel="moname">
        | inputlookup TimeHierarchyVMSummary 
        | search type=VirtualMachine Cluster=CloudCluster 
        | dedup moname
        | sort + moname
    </populatingSearch>
   </input>

[linu1988]

From where the $hostname$ is being passed? i think some module is not properly closed where it should be to pass that variable value from some pulldown/text module for the search to find. Kindly explain my first concern. Thanks