I have a requirement where I want to make a common error dashboard for a set of apps with a textbox. There is an
Errorid field which has different values for different applications i.e
Errorid can be
ID for 1 application and
racfid for another. So I have made a lookup where, for an
Appid, I find out the corresponding
Now if I write the following search:
index=_internal |lookup lookup_name Appid OUTPUT Errorid
This gives me the correct
Errorid Fieldname (like ID) as the field value in the field
Errorid (i hope I'm clear on this)
Now I want to somehow make this field value as the fieldname to search further like below:-
index=_internal |lookup lookup_name Appid OUTPUT Errorid|Errorid.value(like ID)=$textboxvalue$|and so on
Am i doing anything wrong? please advise
When you say,
Errorid.value(like ID)=$textboxvalue$, please Which values your text box is suppose to take in that case? And, is ID is a field in your events?
Hi thanks for the reply,
textbox value will be given by the user, the problem is on the left hand side "Errorid.value(ID)"
Yes ID is a field in my events but this is just 1 case, for a different scenario this ID might be by some other name.
So i want to take the value inside the field errorid and use it as field further in the search string.
nopes the textbox will always have one value, its just that the value will be used as a fieldname further in the search.
Based on what you've written, field aliasing might be a good solution for you: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Addaliasestofields
It allows you to -- in your example -- alias "ID" field to "Errorid" field such that the two searches are identical:
Is the same as:
thanks for the reply,
yeah field alias is an option I tried but that would mean that I need to create some 10-15 aliases. I hope I found something to be able to do it from the search itself.
Here is an example
<form> <label>Text Form Input Element</label> <description>Top N Sourcetypes using Text Form Input</description> <fieldset autoRun="true" submitButton="false"> <input type="text" token="ID" searchWhenChanged="true"> <label>entern the label you need</label> <default>5</default> </input> </fieldset> <row> <table> <title>Your title goes here</title> <searchString>index=_internal |lookup lookup_name Appid OUTPUT Errorid | search ID=$ID$ </searchString> <earliestTime>-24h@h</earliestTime> <latestTime>now</latestTime> <option name="rowNumbers">true</option> </table> </row> </form>