All Apps and Add-ons

Lookup works in search but not in searchTemplate

colinj
Path Finder

Howdy all,

I'm working with the Splunk for VMware app and I'm having trouble with a lookup. The following search works just fine as a plain search

index=vmware source="VirtualMachinePerf" SumRdy_ms="*" perftype="cpu" moname="m-mssqlprd017" 
| lookup TimeHierarchyVMSummary moname AS moname
| eval SumRdyPerCpu_ms=(SumRdy_ms / numCpu) 
| timechart max(SumRdy_ms) AS "Sum Ready Time" max(SumRdyPerCpu_ms) AS "Actual Time Spent" 

However when I try and use it in a searchTemplate for a form

 index=vmware source="VirtualMachinePerf" SumRdy_ms="*" perftype="cpu" moname=$hostname$
 | lookup TimeHierarchyVMSummary moname
 | eval SumRdyPerCpu_ms=(SumRdy_ms / numCpu)
 | timechart max(SumRdy_ms) AS "Sum Ready Time" max(SumRdyPerCpu_ms) AS "Actual Time Spent"

I get the following error:

PARSER: Applying intentions failed Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

Other than the use of a variable in the search when using it in the form everything is the same. If I remove the lookup then it all works just fine but I need the lookup so I can get the 'numCpu' value. Do I need to format the lookup differently when it is used in a searchTemplate?

0 Karma
1 Solution

colinj
Path Finder

Nerd, heal thyself.

So what was going wrong here was the same thing that my mechanic says goes wrong with my car, it was the nut that holds the steering wheel.

What I hadn't taken in to account is the caching that a browser does with a web page. So although I was changing the XML for the page I was not updating that when I viewed the page. Once I realized what I was doing it all worked fine.

So, always make sure that you aren't caching the page you are trying to look at if you are making changes.

Here endeth the lesson.

View solution in original post

0 Karma

colinj
Path Finder

Nerd, heal thyself.

So what was going wrong here was the same thing that my mechanic says goes wrong with my car, it was the nut that holds the steering wheel.

What I hadn't taken in to account is the caching that a browser does with a web page. So although I was changing the XML for the page I was not updating that when I viewed the page. Once I realized what I was doing it all worked fine.

So, always make sure that you aren't caching the page you are trying to look at if you are making changes.

Here endeth the lesson.

0 Karma

linu1988
Champion

Did you check your lookup definition? Does this moname field exists in the lookup table? if not you have to specify the field in the lookup table as moname. It's most probably the problem with lookup definition. Tweak a bit it will work.

0 Karma

colinj
Path Finder

$hostname$ is getting passed from a drop down selection earlier in the form. If I remove the lookup and eval lines from the search it works just fine.

  <input type="dropdown" token="hostname" searchWhenChanged="true">
      <label>Host:</label>
      <populatingSearch fieldForValue="moname" fieldForLabel="moname">
        | inputlookup TimeHierarchyVMSummary 
        | search type=VirtualMachine Cluster=CloudCluster 
        | dedup moname
        | sort + moname
    </populatingSearch>
   </input>
0 Karma

linu1988
Champion

From where the $hostname$ is being passed? i think some module is not properly closed where it should be to pass that variable value from some pulldown/text module for the search to find. Kindly explain my first concern. Thanks

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...