Dashboards & Visualizations

Issues with lookup table file output from dashboard

mcram52
New Member

We've been having issues with a lookup table file (.csv) when trying to output data from a dashboard. There's a blank field at the top of the dashboard for the user to enter their daily production target and a submit button which should then output that number to the lookup table. We have a table visual on the dashboard which displays those numbers from the past few days, so as soon as the user inputs their target it displays on the dashboard as well as outputting to the .csv file. This works sometimes but not consistently. Often the entry will display at first, appearing to work just fine, but then it will disappear later on. Any idea why these entries aren't saving correctly?

  <fieldset submitButton="true" autoRun="true">
<input type="text" token="TheDate">
  <label>Date</label>
  <prefix>, Date = strftime(strptime("</prefix>
  <suffix>","%F"),"%F")</suffix>
  <default>$max_time$</default>
</input>
    <input type="text" token="Daily_Individual_Goal">
  <label>Daily_Individual_Goal</label>
  <default></default>
  <prefix>, Daily_Individual_Goal = </prefix>
</input>

  <table>
    <title>Daily individual goal for $env:user$</title>
    <search>
      <query>| makeresults 
| eval 
null = -9999,
Username = "$env:user$"
$TheDate$
$Daily_Individual_Goal$
| table Date, Username, Daily_Individual_Goal, _time
| append 
[ inputlookup Packaging_User_Targets.csv ] 
| stats
values(Username) as Username
values(Daily_Individual_Goal) as Daily_Individual_Goal
by Date, _time 
| eventstats
latest(Username) as Username
latest(Daily_Individual_Goal) as Daily_Individual_Goal
by Date
| sort 0 - Date, _time
| dedup Date
| foreach * [eval <<FIELD>> = if(<<FIELD>> =-9999,null(),<<FIELD>>)]
| table Date, Username, Daily_Individual_Goal, _time
| outputlookup Packaging_User_Targets.csv
| sort 0 - _time
| where Username = "$env:user$"
| dedup Date
| table Date Daily_Individual_Goal</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table
Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Have you tried appending to the lookup versus wiping it out every time you open the dashboard?

 | outputlookup append=true lookupname.csv

It sounds like a better use case for summary indexing though. Then you could just do something like...

 | stats latest(daily_goal) by user 

in your reporting dashboard.

You might also consider the kvstore for this instead.

In short the outputlookup method you are using is the least desirable design for what you're trying to do if I understand your goals correctly.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...