Dashboards & Visualizations

Link to search with an outputlookup make a "Server error"

Path Finder

Hi,

When I add a link to a search in my dashboard, it works only if I don't finish my search with an outputlookup.

When I put the outputlookup I get a "Server error" but just after that, if I submit the search manually, the search works perfectly. It's only when the search come from my dashboard.

And when I remove the outputlookup from the link in my dashboard, it works too.

I don't undeerstand why Splunk don't "allow" a link to a search with an outputlookup.

Thank you for your help.

Tags (2)
0 Karma

Esteemed Legend

It is not the outputlookup, it is the
$VAR1$_$VAR2$
part. To prove it, try this:

| inputlookup lookup_template.csv
| eval foo="$VAR1$_$VAR2$"
| head 1
| outputlookup DEBUG.csv
0 Karma

Path Finder

I already tried before, the outputlookup doesn't work with any csv filename.

0 Karma

Esteemed Legend

You need to URL Encode the URL; are you doing that?
https://www.urlencoder.org/

0 Karma

Path Finder

I don't understand, I'm using the "link to a search" function in the drilldown menu. Why do I need to encode an URL? Which URL?

0 Karma

Esteemed Legend

Got it. Never mind.

0 Karma

Legend

HI @JuGuSm,
could you share your search?

Ciao.Giuseppe

0 Karma

Path Finder

The search is very simple, I just want to copy a lookup template :

| inputlookup lookup_template.csv | outputlookup $VAR1$_$VAR2$.csv

0 Karma