Dashboards & Visualizations

How to use pass token value as lookup file?

dw_jcro
Loves-to-Learn Lots

So the goal is to to have a drilldown perform an eval which sets a token with the "lookup-dataset" value for another panel to use in performing the lookup.

Lookup documentation states the syntax is:

 

| lookup <lookup-dataset> ...

 


The eval includes a case command containing 3 match commands - the results of this should be set into a token.

 

<drilldown>
  <unset token="lookup_token"></unset>
  <eval token="lookup_token">case(match("$row.field1$","abc"),"lookup1",match("$row.field1$","def"),"lookup2",match("$row.field1$","xyz"),"lookup1")</eval>
</drilldown>

 



And another panel does:

 

<search depends="$lookup_token$" base="the_base_search">
  <query>| lookup $lookup_token$ lookup_value as field_value</query>
</search>

 


But the eval doesn't appear to be re-evaluating on clicking a new row within the first panel - checking the search jobs shows it only ever seems to get the first eval value.

Is there something I am missing here?

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

$row.<field>$ is always the first row of the results. If you want the first column from the clicked row, you should use $click.value$

0 Karma

dw_jcro
Loves-to-Learn Lots

I tested this out, because I have other panels whose Drilldown actions for "On Click" set tokens based on the "$row.<field-name>$", and those tokens are being set with the correct values.

I do think that, to your point, the token, "$result.<field-name>$", sources data from the first row in a result set though.

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...