All Apps and Add-ons

Lookup works in search but not in searchTemplate

colinj
Path Finder

Howdy all,

I'm working with the Splunk for VMware app and I'm having trouble with a lookup. The following search works just fine as a plain search

index=vmware source="VirtualMachinePerf" SumRdy_ms="*" perftype="cpu" moname="m-mssqlprd017" 
| lookup TimeHierarchyVMSummary moname AS moname
| eval SumRdyPerCpu_ms=(SumRdy_ms / numCpu) 
| timechart max(SumRdy_ms) AS "Sum Ready Time" max(SumRdyPerCpu_ms) AS "Actual Time Spent" 

However when I try and use it in a searchTemplate for a form

 index=vmware source="VirtualMachinePerf" SumRdy_ms="*" perftype="cpu" moname=$hostname$
 | lookup TimeHierarchyVMSummary moname
 | eval SumRdyPerCpu_ms=(SumRdy_ms / numCpu)
 | timechart max(SumRdy_ms) AS "Sum Ready Time" max(SumRdyPerCpu_ms) AS "Actual Time Spent"

I get the following error:

PARSER: Applying intentions failed Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

Other than the use of a variable in the search when using it in the form everything is the same. If I remove the lookup then it all works just fine but I need the lookup so I can get the 'numCpu' value. Do I need to format the lookup differently when it is used in a searchTemplate?

0 Karma
1 Solution

colinj
Path Finder

Nerd, heal thyself.

So what was going wrong here was the same thing that my mechanic says goes wrong with my car, it was the nut that holds the steering wheel.

What I hadn't taken in to account is the caching that a browser does with a web page. So although I was changing the XML for the page I was not updating that when I viewed the page. Once I realized what I was doing it all worked fine.

So, always make sure that you aren't caching the page you are trying to look at if you are making changes.

Here endeth the lesson.

View solution in original post

0 Karma

colinj
Path Finder

Nerd, heal thyself.

So what was going wrong here was the same thing that my mechanic says goes wrong with my car, it was the nut that holds the steering wheel.

What I hadn't taken in to account is the caching that a browser does with a web page. So although I was changing the XML for the page I was not updating that when I viewed the page. Once I realized what I was doing it all worked fine.

So, always make sure that you aren't caching the page you are trying to look at if you are making changes.

Here endeth the lesson.

0 Karma

linu1988
Champion

Did you check your lookup definition? Does this moname field exists in the lookup table? if not you have to specify the field in the lookup table as moname. It's most probably the problem with lookup definition. Tweak a bit it will work.

0 Karma

colinj
Path Finder

$hostname$ is getting passed from a drop down selection earlier in the form. If I remove the lookup and eval lines from the search it works just fine.

  <input type="dropdown" token="hostname" searchWhenChanged="true">
      <label>Host:</label>
      <populatingSearch fieldForValue="moname" fieldForLabel="moname">
        | inputlookup TimeHierarchyVMSummary 
        | search type=VirtualMachine Cluster=CloudCluster 
        | dedup moname
        | sort + moname
    </populatingSearch>
   </input>
0 Karma

linu1988
Champion

From where the $hostname$ is being passed? i think some module is not properly closed where it should be to pass that variable value from some pulldown/text module for the search to find. Kindly explain my first concern. Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...