How to add lookup values as filter in dashboard and filter dashboard data

[koreamit3483]

I have data receiving through forwarder which has SERVER_NAME with other details and i have another lookup created adding a csv file which holds data as SERVER_NAME, OWNER and REGION.

my current dashboard have a filter using SERVER_NAME coming from forwarder and now i need to create filter in dashboard of OWNER and REGION, which are from lookup and not from the data from forwarder.

I created the filter for OWNER and REGION and created tokens for them as "$owner_t$" and "$region_t$" which i am using in dashboard data as 

| index = XXX  OWNER="$owner_t$" and REGION="$region_t$"

when i select these tokens the data on dashboard is not getting filtered and shows as "No results found"

Can some one guide me where i am going wrong.

[gcusello · Accepted solution]

Hi @koreamit3483,

you have two ways:

• to use these tokens after the lookup command,
• create au automatic lookup.

In the first case, you have to create two dropdowns using the lookup:

| inputlookup your_lookup.csv | dedup OWNER | fields OWNER

and

| inputlookup your_lookup.csv | dedup REGION | fields REGION

then put in your search after the lookup command:

index = XXX  
| lookup your_lookup.csv SERVER_NAME OUTPUT OWNER REGION
| search OWNER="$owner_t$" and REGION="$region_t$"
| table ...

For the second way, you could follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.3/Knowledge/DefineanautomaticlookupinSplunkWeb

Ciao.

Giuseppe

[koreamit3483]

@gcusello 

This is exactly what i was looking for and have resolved my query.

Thank you so much..