Dashboards & Visualizations

Issues with lookup table file output from dashboard

mcram52
New Member

We've been having issues with a lookup table file (.csv) when trying to output data from a dashboard. There's a blank field at the top of the dashboard for the user to enter their daily production target and a submit button which should then output that number to the lookup table. We have a table visual on the dashboard which displays those numbers from the past few days, so as soon as the user inputs their target it displays on the dashboard as well as outputting to the .csv file. This works sometimes but not consistently. Often the entry will display at first, appearing to work just fine, but then it will disappear later on. Any idea why these entries aren't saving correctly?

  <fieldset submitButton="true" autoRun="true">
<input type="text" token="TheDate">
  <label>Date</label>
  <prefix>, Date = strftime(strptime("</prefix>
  <suffix>","%F"),"%F")</suffix>
  <default>$max_time$</default>
</input>
    <input type="text" token="Daily_Individual_Goal">
  <label>Daily_Individual_Goal</label>
  <default></default>
  <prefix>, Daily_Individual_Goal = </prefix>
</input>

  <table>
    <title>Daily individual goal for $env:user$</title>
    <search>
      <query>| makeresults 
| eval 
null = -9999,
Username = "$env:user$"
$TheDate$
$Daily_Individual_Goal$
| table Date, Username, Daily_Individual_Goal, _time
| append 
[ inputlookup Packaging_User_Targets.csv ] 
| stats
values(Username) as Username
values(Daily_Individual_Goal) as Daily_Individual_Goal
by Date, _time 
| eventstats
latest(Username) as Username
latest(Daily_Individual_Goal) as Daily_Individual_Goal
by Date
| sort 0 - Date, _time
| dedup Date
| foreach * [eval <<FIELD>> = if(<<FIELD>> =-9999,null(),<<FIELD>>)]
| table Date, Username, Daily_Individual_Goal, _time
| outputlookup Packaging_User_Targets.csv
| sort 0 - _time
| where Username = "$env:user$"
| dedup Date
| table Date Daily_Individual_Goal</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table
Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Have you tried appending to the lookup versus wiping it out every time you open the dashboard?

 | outputlookup append=true lookupname.csv

It sounds like a better use case for summary indexing though. Then you could just do something like...

 | stats latest(daily_goal) by user 

in your reporting dashboard.

You might also consider the kvstore for this instead.

In short the outputlookup method you are using is the least desirable design for what you're trying to do if I understand your goals correctly.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...