Add filtered lookup list to Dashboard?

[BradOH]

Hey there, I'm trying to create a custom/filtered list of lookups to simplify edits by end users pulling reports. I've dug through the docs and can't find anything, although perhaps I'm missing it in my searches.  

What I was hoping would be to add a custom HREF link in the menu to a filtered lookup list, but it doesn't appear the lookup_list accepts parameters (or I haven't found the right ones). For example...

https://splunk-srvr/en-US/app/lookup_editor/lookup_edit?namespace=user_reports_app&type=csv

If this isn't possible, the other option I had thought of was a dashboard section with a filtered list of the appropriate lookups similar to the Lookup App overview page, but this appears to be build directly in the app using javascript and not something easily replicated.

Have I missed something completely obvious, or is this even possible?  Thanks!

[gcusello]

Hi @BradOH ,

the only solution is to open a lookup using the Lookup Editor app (https://splunkbase.splunk.com/app/1724😞

adding a row like the following in the menu App editor:

<a href="/app/lookup_editor/lookup_edit?owner=nobody&amp;namespace=myapp&amp;lookup=mylookup&amp;type=csv">MyLookup</a>

Ciao.

Giuseppe

[BradOH]

Thanks, that's what we're doing now for the individual lookups, but I was hoping to find an option to build this dynamically, similar to the saved source option in navigation xml.

Well at least that confirms I wasn't missing something obvious!

[gcusello]

Hi @BradOH ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[livehybrid · Accepted solution]

Hi @BradOH 

Its not possible to limit the display on the lookup editor app page by passing params in the URI, however this might(??) help...Im using the rest endpoint "/services/data/lookup-table-files/" to get a table of lookups including their app and owner, then setting this a table in a dashboard which when you click on the row takes you to the edit page in the lookup editor app (e.g. "/en-US/app/lookup_editor/lookup_edit?owner=nobody&namespace=Splunk_Security_Essentials&lookup=account_status_tracker.csv&type=csv")

Here is the JSON for the dashboard studio dashboard if this helps:

{
    "title": "LookupDrilldown",
    "description": "",
    "inputs": {},
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_wTIE1OIS": {
            "dataSources": {
                "primary": "ds_lwh4A7Zo"
            },
            "eventHandlers": [
                {
                    "options": {
                        "tokens": [
                            {
                                "key": "row._uri.value",
                                "token": "uri"
                            }
                        ]
                    },
                    "type": "drilldown.setToken"
                },
                {
                    "options": {
                        "newTab": true,
                        "url": "$uri$"
                    },
                    "type": "drilldown.customUrl"
                }
            ],
            "options": {
                "count": 20,
                "dataOverlayMode": "none",
                "drilldown": "none",
                "showInternalFields": false,
                "showRowNumbers": false
            },
            "type": "splunk.table"
        }
    },
    "dataSources": {
        "ds_lwh4A7Zo": {
            "name": "Table search",
            "options": {
                "query": "| rest /services/data/lookup-table-files/\n| eval _uri=\"/en-US/app/lookup_editor/lookup_edit?owner=\".'eai:acl.owner'.\"&namespace=\".'eai:acl.app'.\"&lookup=\".title.\"&type=csv\"\n| table eai:acl.app title  eai:acl.owner _uri",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [],
        "layoutDefinitions": {
            "layout_1": {
                "options": {
                    "display": "auto",
                    "height": 960,
                    "width": 1440
                },
                "structure": [
                    {
                        "item": "viz_wTIE1OIS",
                        "position": {
                            "h": 250,
                            "w": 1440,
                            "x": 0,
                            "y": 0
                        },
                        "type": "block"
                    }
                ],
                "type": "absolute"
            }
        },
        "options": {},
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[BradOH]

Well, helllooooo. Definitely not obvious, but this will do the trick nicely.  Thanks for sharing!