add lookup data into dashboard panels

[selvam_sekar]

Hi,

I have requirement to add the lookup data into dashboard panels. Please could you review and help on this?

how to add the lookup data into the spl query to display region fullname?

SPl:

  index=abc sourcetype=a.1 source=a.2  | search region IN (a,b,c,d,e,f,g,h,i,j,l,m) | chart count by region

Lookup data: look file name regiondetails.csv

Alias	Name
a	america
b	brazil
c	canada
d	dubai

[isoutamo]

Hi

I think that you should start with these documentations:

• https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Aboutlookupsandfieldactions
• https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Usefieldlookupstoaddinformationtoyourev...
• https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/LookupexampleinSplunkWeb

Those will guide you step by step, how to define and use lookups.

r. Ismo

[selvam_sekar]

@isoutamo I have gone through the document link but i  am not able to fix the issue.

I am trying to bring the fullname of the region from lookup into search results.

[isoutamo]

After you have define those lookups as described on those links you could use it as

| makeresults
| eval foo="a"
``` Previous lines generate example data and should replaced your real search ```
| lookup regiondetails Alias as foo

Above example gives you a result like

Name	_time	foo
america	2024-01-05 11:44:56	a

If you want to do it without lookup command you must define automatic lookup. You find that from previous links.