Archive

inputlookup searches

Engager

How to use a inputlook to run several different indexes depending on which option the user selects on the drop down and then using the lookup to collate the different fields into one field which stops having to rewrite a query.

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

How about having a dashboard with 'drop-down' showing the list of possible application names ? . something like below where you can populate the values and setup default/initial values etc.. The application selected by user is then available in the "appname" token.

..
..

|inputlookup xyz | stats count by application | table application

//using value from token
You can then use the value captured in token to select required application/index/sourcetype from the lookup
|inputlookup xyz | search APPLICATION=$appname$

Pls also refer to:

https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens

0 Karma

SplunkTrust
SplunkTrust

This doesn't make sense.. You should include some examples of what your expecting

Also, why use inputlookup over lookup? Why use lookup over coalesce?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!