Why is outputlookup not working in dashboard?

[johnjester]

I initialize a lookup file using:

| makeresults
| outputlookup status.csv

I then have this simple search:

| inputlookup status.csv
| eval a=if(isnull(a),1,a+1)
| outputlookup status.csv

This works fine when I run it in Search.  The "a" value gets incremented each time the search is executed.

But if I put the same thing in a dashboard it results in an error and does not update the lookup table.

In a classic dashboard, the panel with this search just says "Search was cancelled".

In dashboard studio, a panel with this search as its data source reports this error: "Unexpected non-whitespace character after JSON at position 4"

Removing the outputlookup command in either case makes the search work, and it shows an up-to-date value for "a" (given how many times the search was executed in Search).

I have no clue what I'm doing wrong with what seems like such a simple thing - really hoping someone can help me!

[ITWhisperer]

Are you running a multi-search-head environment?

I have found that updates to csv are not instantaneous, so is there perhaps a lag between the outputlookup and inputlookup?

[gcusello]

Hi @johnjester,

I used outputlookup in a Classic dashboard and it runs without errors.

The only issue is that the lookup is updated at every dashboard reload.

I didn't tried with Dashboard Studio, but it should be the same thing.

Maybe there something else.

Ciao.

Giuseppe