Dashboards & Visualizations

How to get dashboard search textfield working with lookup values or values of ip location

david1395
New Member

I have a table in my dashboard:
my search*********

"$search_field$"
|lookup customer.csv license_hash as license_hash OUTPUT customer_id customer_name
|ip location client_ip
|table customer_id,customer_name,client_ip.......

In the dashboard I have a search field and on the table a drill down on this search field.

The problem: w
When I click on values of customer_id,client_ip, City,_Customer_name.....
I get no results....of course not because of the lookup after the search field in the search.

Wich changes I have to do to make it possible to search with this values?

to add |search "§search_field§" after the lookup doesn't work.

0 Karma

DalJeanis
Legend

You are taking an input record, then using the input field license_hash to look that up and get customer_id and customer_name

It looks like you then intend to use command iplocation to look up the location info from the field client_ip. however, at that point you don't appear to actually have a field named client_ip. Is that in the initial event record, or is it in the lookup table, or is it nowhere?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...