Dashboards & Visualizations

How can I use multiple lookup tables in a dashboard?

JD_Symantec
New Member

Trying to develop a pull-down field in a dashboard to select from multiple lookup tables that include different usernames? for example, the lookups may be labeled USECASE1, USECASE2, USECASE3, USECASE4, etc.

Tags (2)
0 Karma

vasanthmss
Motivator

Hi JD,

if you want to display the user field values from multiple lookup table then the below query will helps you, Assuming all your lookup(USECASE1,etc) contains user field named user.

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 | table user] | append[ | inputlookup USECASE3| table user] | stats count by user | table user

If you have the different field names in other lookup you can rename it, as like the below search

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 |rename user2 as user | table user] | append[ | inputlookup USECASE3| rename user3 as user | table user] | stats count by user | table user

If you are looking for a list of lookup table available across the application and user this will help you.

|rest /servicesNS/admin/search/data/lookup-table-files | table title

if you want you can retrieve based on required user / app etc..

Hope this will help you.

Cheers!

V
0 Karma
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...