Why is outputlookup not working in dashboard?

New Member


I initialize a lookup file using:


| makeresults
| outputlookup status.csv


I then have this simple search:


| inputlookup status.csv
| eval a=if(isnull(a),1,a+1)
| outputlookup status.csv


This works fine when I run it in Search.  The "a" value gets incremented each time the search is executed.

But if I put the same thing in a dashboard it results in an error and does not update the lookup table.

In a classic dashboard, the panel with this search just says "Search was cancelled".

In dashboard studio, a panel with this search as its data source reports this error: "Unexpected non-whitespace character after JSON at position 4"

Removing the outputlookup command in either case makes the search work, and it shows an up-to-date value for "a" (given how many times the search was executed in Search).

I have no clue what I'm doing wrong with what seems like such a simple thing - really hoping someone can help me!

Labels (1)
0 Karma


Are you running a multi-search-head environment?

I have found that updates to csv are not instantaneous, so is there perhaps a lag between the outputlookup and inputlookup?

0 Karma

Esteemed Legend

Hi @johnjester,

I used outputlookup in a Classic dashboard and it runs without errors.

The only issue is that the lookup is updated at every dashboard reload.

I didn't tried with Dashboard Studio, but it should be the same thing.

Maybe there something else.



0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...