allow user to run search contained in lookup


I have created a lookup. fairly basic 2 columns, column 1 has an ID the second a search string.

ID searchstring
1 source =xyz

My users get the ID from a separate system and rather than remember the search string or lookup the string themselves they would like to run the search through itself using the search id.

e.g. | inputlookup table where ID=1 | fields searchstring | run searchstring as a splunksearch

Is this possible?


Tags (1)
0 Karma


For your requirement, you can try using 'macros'.

You can find macro option by navigation through - Settings->Advanced search->Search macros


0 Karma


Can you accept the answer if it's helped you? Thanks.

0 Karma


Maybe with the map command. I will try making an example and check if its possible.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...