Dashboards & Visualizations

Why is my code to use a text field to update a csv lookup file via outputlookup and the submit button not working?

mrgibbon
Contributor

Hi all,

Can anyone tell me why this code won't work? I'm trying to use a text field to update a lookup file via outputlookup.

In previous code, I retrieve the value and display it as a single figure. This code below is to allow the user to enter a new value and submit it to the lookup csv file, so I'm changing only the value field for the $sla$ field.
CSV file looks like this:

sla value
ram 8
lat 1000
etc....

    <label>Value</label>
    <populatingSearch  fieldForValue="value" fieldForLabel="name" >
                  | inputlookup sla_lookup.csv | search sla=$sla$ | fields value | eval value=$value$ | outputlookup sla_lookup.csv
    </populatingSearch>
</input> 
</fieldset>

Thanks in advance!

0 Karma

mrgibbon
Contributor

When I hit the submit button, the end of the page URL changes to this:

form_test?earliest=0&latest=&form.sla=ram
0 Karma

tachifelix
Path Finder

make sure that your are using outputlookup command to create the file.

0 Karma

mrgibbon
Contributor

the file already exists, and can be read successfully in the previous code 🙂

0 Karma

tachifelix
Path Finder

your file is in this following directory?

$SPLUNK_HOME/etc/system/lookups
0 Karma

mrgibbon
Contributor

Nope, its in the app's folder:

$SPLUNK_HOME/etc/apps/APPNAME/lookups

0 Karma

tachifelix
Path Finder

1.you can't use the token in populatingSearch tag
2.using search in this tag most be not inline.
3.you most use count or table to pick data in the field.
4. something like this:

|inputlookup file_name|stats count by field_name
0 Karma

mrgibbon
Contributor

This is code before the first section I posted, its works fine:

<input type="dropdown" token="sla" searchWhenChanged="true"  >
  <label>Choose SLA:</label>
  <search>
    <query>| inputlookup sla_lookup.csv </query>
    <earliest>-5m</earliest>
    <latest>now</latest>
  </search>
  <selectFirstChoice>true</selectFirstChoice>
  <fieldForLabel>name</fieldForLabel>
  <fieldForValue>sla</fieldForValue>
</input>
0 Karma

tachifelix
Path Finder

so your csv file have only one field: sla
i think that your ok with this preview code.

0 Karma

mrgibbon
Contributor

Two fields.

sla and value

0 Karma

tachifelix
Path Finder

select the field that you want to populate in your dropdown with this code:

|inputlookup file_name.csv |table sla
0 Karma

mrgibbon
Contributor

cool. How do I fix the submit button?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...