Why is outputlookup not working in dashboard?

New Member


I initialize a lookup file using:


| makeresults
| outputlookup status.csv


I then have this simple search:


| inputlookup status.csv
| eval a=if(isnull(a),1,a+1)
| outputlookup status.csv


This works fine when I run it in Search.  The "a" value gets incremented each time the search is executed.

But if I put the same thing in a dashboard it results in an error and does not update the lookup table.

In a classic dashboard, the panel with this search just says "Search was cancelled".

In dashboard studio, a panel with this search as its data source reports this error: "Unexpected non-whitespace character after JSON at position 4"

Removing the outputlookup command in either case makes the search work, and it shows an up-to-date value for "a" (given how many times the search was executed in Search).

I have no clue what I'm doing wrong with what seems like such a simple thing - really hoping someone can help me!

Labels (1)
0 Karma


Are you running a multi-search-head environment?

I have found that updates to csv are not instantaneous, so is there perhaps a lag between the outputlookup and inputlookup?

0 Karma


Hi @johnjester,

I used outputlookup in a Classic dashboard and it runs without errors.

The only issue is that the lookup is updated at every dashboard reload.

I didn't tried with Dashboard Studio, but it should be the same thing.

Maybe there something else.



0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...