Link to search with an outputlookup make a "Server error"

[JuGuSm]

Hi,

When I add a link to a search in my dashboard, it works only if I don't finish my search with an outputlookup.

When I put the outputlookup I get a "Server error" but just after that, if I submit the search manually, the search works perfectly. It's only when the search come from my dashboard.

And when I remove the outputlookup from the link in my dashboard, it works too.

I don't undeerstand why Splunk don't "allow" a link to a search with an outputlookup.

Thank you for your help.

[woodcock]

It is not the outputlookup, it is the
$VAR1$_$VAR2$ part. To prove it, try this:

| inputlookup lookup_template.csv
| eval foo="$VAR1$_$VAR2$"
| head 1
| outputlookup DEBUG.csv

[JuGuSm]

I already tried before, the outputlookup doesn't work with any csv filename.

[woodcock]

You need to URL Encode the URL; are you doing that?
https://www.urlencoder.org/

[JuGuSm]

I don't understand, I'm using the "link to a search" function in the drilldown menu. Why do I need to encode an URL? Which URL?

[woodcock]

Got it. Never mind.

[gcusello]

HI @JuGuSm,
could you share your search?

Ciao.Giuseppe

[JuGuSm]

The search is very simple, I just want to copy a lookup template :

| inputlookup lookup_template.csv | outputlookup $VAR1$_$VAR2$.csv