Dashboards & Visualizations

How can I use multiple lookup tables in a dashboard?

JD_Symantec
New Member

Trying to develop a pull-down field in a dashboard to select from multiple lookup tables that include different usernames? for example, the lookups may be labeled USECASE1, USECASE2, USECASE3, USECASE4, etc.

Tags (2)
0 Karma

vasanthmss
Motivator

Hi JD,

if you want to display the user field values from multiple lookup table then the below query will helps you, Assuming all your lookup(USECASE1,etc) contains user field named user.

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 | table user] | append[ | inputlookup USECASE3| table user] | stats count by user | table user

If you have the different field names in other lookup you can rename it, as like the below search

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 |rename user2 as user | table user] | append[ | inputlookup USECASE3| rename user3 as user | table user] | stats count by user | table user

If you are looking for a list of lookup table available across the application and user this will help you.

|rest /servicesNS/admin/search/data/lookup-table-files | table title

if you want you can retrieve based on required user / app etc..

Hope this will help you.

Cheers!

V
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...