How to append a value from lookup file to the event based on some condition

[sangs8788]

I have a lookup file in below format
Product|R
AAAA|/ffff/*

I have some events i like R="/fff/abc" and some like R="/ffff/xyz.jsp"

Using this query i am able to fetch R counts
index=prod* |search [|inputlookup product-dashboard-lookup.csv |fields R ]|stats count as Rcount by R

Result for the above query is
R | Rcount
/fff/abc|10
/fff/xyz.jsp | 10

But i would like to get by Product instead of R something like below

AAAA | 20

How do i achieve this ?

[HiroshiSatoh]

Try this!

index=prod*  [|inputlookup product-dashboard-lookup.csv |fields R ]
|lookup product-dashboard-lookup.csv R
|stats count as Rcount by ProductName

[sangs8788]

Doesnt work since the R has wildcard in lookup file whereas the events contain the actual R.

[HiroshiSatoh]

You can use wild card for LOOKUP.
https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

If the number of cases is small, you can also use MAP.
| inputlookup product-dashboard-lookup.csv
| map [search index=prod* R=$R$|eval ProductName=$ProductName$]
| stats count as Rcount by ProductName
※We do not consider duplication and number limit.

It is complicated when there are many cases.
Please make your own with reference to the link below.
https://answers.splunk.com/answers/595766/need-to-display-zero-if-count-is-zero-for-data-tha.html

[sangs8788]

Map does work. But the problem i am facing now is i am unable to add this as one of the panel in the Dashboard. It says "Search is waiting for Input". I guess its becuase of the dynamic parameter passed. How do i make the search as part of a Dashboard ?

[HiroshiSatoh]

Please tell us the search sentences and tokens you are using.

[sangs8788]

Below is the query added as a panel to dashboard,

|inputlookup product-dashboard-lookup.csv |search Product=* AND R=* | map [search host=prod* R="$R$*" |eval Product="$Product$" ]|stats count by Product

The dashboard contains "Time" as input panel.

[HiroshiSatoh]

I made a grammar mistake. Also escape the double quotes.

|inputlookup product-dashboard-lookup.csv |search Product=* AND R=*
| map search="search host=prod* R=\"$R$*\" |eval Product=\"$Product$\""
|stats count by Product

[sangs8788]

Still no luck. It is still waiting for input

[sangs8788]

Individually both query works. But it doesnt work when added as a panel in a dashboard

[somesoni2]

Wildcard lookup is the way to go here.