Issue with Table Refresh After Updating Lookup via JavaScript

[molla]

Hello,

I have a Classic Dashboard with a table that retrieves data using the following search:

index=myindex| lookup mylookup.csv field1 OUTPUT field2

Through JavaScript, I update the mylookup.csv file using outputlookup, and after the update is completed, I trigger a refresh of the search in the panel using:

var mainSearch = mvc.Components.get("my_table_search");

if (mainSearch) { mainSearch.startSearch(); }

 

Even though the data is correctly written into the lookup (mylookup.csv), the table does not reflect the updated data when the search is refreshed.

 

How can I ensure that Splunk reloads the lookup with the latest data in the table after my JavaScript updates it?

Is there a way to force Splunk to bypass any caching of the lookup file?

 

TY 🙂

[livehybrid · Accepted solution]

Hi @molla 

Try adding local=true to your lookup command to see if this resolves the issue you are seeing.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[molla]

Hi @livehybrid,

I edited the search and now is working 🙂 Thank you! 

A quick question, now I have a single SH environment, If I will switch to a SHC environment do I have to change this logic?

[livehybrid]

Hi @molla 

Im glad this helped - this change means that it runs on the SH you are running the search on, rather than on the search peers (indexers) -  if you move from a SH to SHC then the lookup will replicate to the other nodes (quite quickly) so hopefully you wont see this issue!

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will