Dashboards & Visualizations

Issues with lookup table file output from dashboard

New Member

We've been having issues with a lookup table file (.csv) when trying to output data from a dashboard. There's a blank field at the top of the dashboard for the user to enter their daily production target and a submit button which should then output that number to the lookup table. We have a table visual on the dashboard which displays those numbers from the past few days, so as soon as the user inputs their target it displays on the dashboard as well as outputting to the .csv file. This works sometimes but not consistently. Often the entry will display at first, appearing to work just fine, but then it will disappear later on. Any idea why these entries aren't saving correctly?

  <fieldset submitButton="true" autoRun="true">
<input type="text" token="TheDate">
  <prefix>, Date = strftime(strptime("</prefix>
    <input type="text" token="Daily_Individual_Goal">
  <prefix>, Daily_Individual_Goal = </prefix>

    <title>Daily individual goal for $env:user$</title>
      <query>| makeresults 
| eval 
null = -9999,
Username = "$env:user$"
| table Date, Username, Daily_Individual_Goal, _time
| append 
[ inputlookup Packaging_User_Targets.csv ] 
| stats
values(Username) as Username
values(Daily_Individual_Goal) as Daily_Individual_Goal
by Date, _time 
| eventstats
latest(Username) as Username
latest(Daily_Individual_Goal) as Daily_Individual_Goal
by Date
| sort 0 - Date, _time
| dedup Date
| foreach * [eval <<FIELD>> = if(<<FIELD>> =-9999,null(),<<FIELD>>)]
| table Date, Username, Daily_Individual_Goal, _time
| outputlookup Packaging_User_Targets.csv
| sort 0 - _time
| where Username = "$env:user$"
| dedup Date
| table Date Daily_Individual_Goal</query>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
Tags (1)
0 Karma


Have you tried appending to the lookup versus wiping it out every time you open the dashboard?

 | outputlookup append=true lookupname.csv

It sounds like a better use case for summary indexing though. Then you could just do something like...

 | stats latest(daily_goal) by user 

in your reporting dashboard.

You might also consider the kvstore for this instead.

In short the outputlookup method you are using is the least desirable design for what you're trying to do if I understand your goals correctly.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...