Dashboards & Visualizations

Issues with lookup table file output from dashboard

mcram52
New Member

We've been having issues with a lookup table file (.csv) when trying to output data from a dashboard. There's a blank field at the top of the dashboard for the user to enter their daily production target and a submit button which should then output that number to the lookup table. We have a table visual on the dashboard which displays those numbers from the past few days, so as soon as the user inputs their target it displays on the dashboard as well as outputting to the .csv file. This works sometimes but not consistently. Often the entry will display at first, appearing to work just fine, but then it will disappear later on. Any idea why these entries aren't saving correctly?

  <fieldset submitButton="true" autoRun="true">
<input type="text" token="TheDate">
  <label>Date</label>
  <prefix>, Date = strftime(strptime("</prefix>
  <suffix>","%F"),"%F")</suffix>
  <default>$max_time$</default>
</input>
    <input type="text" token="Daily_Individual_Goal">
  <label>Daily_Individual_Goal</label>
  <default></default>
  <prefix>, Daily_Individual_Goal = </prefix>
</input>

  <table>
    <title>Daily individual goal for $env:user$</title>
    <search>
      <query>| makeresults 
| eval 
null = -9999,
Username = "$env:user$"
$TheDate$
$Daily_Individual_Goal$
| table Date, Username, Daily_Individual_Goal, _time
| append 
[ inputlookup Packaging_User_Targets.csv ] 
| stats
values(Username) as Username
values(Daily_Individual_Goal) as Daily_Individual_Goal
by Date, _time 
| eventstats
latest(Username) as Username
latest(Daily_Individual_Goal) as Daily_Individual_Goal
by Date
| sort 0 - Date, _time
| dedup Date
| foreach * [eval <<FIELD>> = if(<<FIELD>> =-9999,null(),<<FIELD>>)]
| table Date, Username, Daily_Individual_Goal, _time
| outputlookup Packaging_User_Targets.csv
| sort 0 - _time
| where Username = "$env:user$"
| dedup Date
| table Date Daily_Individual_Goal</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table
Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Have you tried appending to the lookup versus wiping it out every time you open the dashboard?

 | outputlookup append=true lookupname.csv

It sounds like a better use case for summary indexing though. Then you could just do something like...

 | stats latest(daily_goal) by user 

in your reporting dashboard.

You might also consider the kvstore for this instead.

In short the outputlookup method you are using is the least desirable design for what you're trying to do if I understand your goals correctly.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...