Installation

Why is outputlookup not working in dashboard?

johnjester
New Member

 

I initialize a lookup file using:

 

| makeresults
| outputlookup status.csv

 

I then have this simple search:

 

| inputlookup status.csv
| eval a=if(isnull(a),1,a+1)
| outputlookup status.csv

 


This works fine when I run it in Search.  The "a" value gets incremented each time the search is executed.

But if I put the same thing in a dashboard it results in an error and does not update the lookup table.

In a classic dashboard, the panel with this search just says "Search was cancelled".

In dashboard studio, a panel with this search as its data source reports this error: "Unexpected non-whitespace character after JSON at position 4"

Removing the outputlookup command in either case makes the search work, and it shows an up-to-date value for "a" (given how many times the search was executed in Search).

I have no clue what I'm doing wrong with what seems like such a simple thing - really hoping someone can help me!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you running a multi-search-head environment?

I have found that updates to csv are not instantaneous, so is there perhaps a lag between the outputlookup and inputlookup?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @johnjester,

I used outputlookup in a Classic dashboard and it runs without errors.

The only issue is that the lookup is updated at every dashboard reload.

I didn't tried with Dashboard Studio, but it should be the same thing.

Maybe there something else.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...