How to search field with inputlookup?

[POR160893]

Hi,

I am creating a dashboard where the data is provided via CSV. So, I am using the inputlookup command. 

However, I need to search on one specific field (or column) on the CSV and I am currently using this but it is not working:

| inputlookup ABC
| search Device Name = "sdf"

Can you please help?

[POR160893]

I think the issue is the field name is composed of 2 words "Device Name" and I am not sure how to search with this ...

[ITWhisperer]

Will where work better for you?

| inputlookup ABC
| where 'Device Name' = "sdf"

Note that the field name needs to be in single quotes if it has embedded spaces or other special characters 

[POR160893]

No quiet 😞

[ITWhisperer]

The where command will use a case-sensitive comparison whereas search uses case-insensitive comparisons. Is this perhaps the issue?

[POR160893]

What did I do incorrectly? The field name is "Device Name".

[ITWhisperer]

What about if you just search for buemwgproxy02 without the field name

| search "buemwgproxy02"

[POR160893]

No luck 😣

[POR160893]

Hey,

So, I was just asked to further update this dashboard so that the default values of the panels show ALL values of the lookup tables.

The tricky bit is incoporating that requets into the current query which is as follows:
<panel>
<title>McAfee</title>
<table>
<search>
<query>
| inputlookup Migration-Status-McAfee
| where match('Device Name',"$mcafee_tok$")</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
</table>
</panel>

However, when I search for all, it fails:

Can you please help?

Thanks so much!

[ITWhisperer]

Make the all value ".*" instead of just "*" - if necessary, if you are using that token elsewhere successfully, you may need to eval a new token to cater for this case.

[POR160893]

This was perfect!
Thanks a million and learned something new here too!

[POR160893]

Hey,

So, I was just asked to further update this dashboard so that the default values of the panels show ALL values of the lookup tables.

The tricky bit is incoporating that requets into the current query which is as follows:
<panel>
<title>McAfee</title>
<table>
<search>
<query>
| inputlookup Migration-Status-McAfee
| where match('Device Name',"$mcafee_tok$")</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
</table>
</panel>

However, when I search for all, it fails:

Can you please help?

Thanks so much!

[ITWhisperer · Accepted solution]

| where match('Device Name',"buemwgproxy02")

[POR160893]

Thank you  😀