Splunk Search

How to append results to dropdown?

thenormalone
Path Finder

I have a dashboard that has a dropdown which takes in the values from a csv file. Is there a way I can add on to the results of the csv file without altering the csv file so that these two results show up in the dropdown?

<search>
<query> | inputlookup domains.csv | fields display, domain | dedup domain
</query>
<earliest>-24h@h</earliest>
<latest>now</latest> </search>

I need to add a couple more results to the dropdown that I'm currently extracting from the csv file. 

Any help is appreciated!

Labels (2)
0 Karma

yeahnah
Motivator

Hi @thenormalone 

You sure can, try this...

<search>
<query> | inputlookup domains.csv | inputlookup append=true other_domains.csv | fields display, domain | dedup domain
</query>
<earliest>-24h@h</earliest>
<latest>now</latest> </search>

 Hope it helps

thenormalone
Path Finder

Thanks for the response. I should've mentioned that I have tried that and it works, I'm curious if there a way to append results without using another cvs file?

0 Karma

yeahnah
Motivator

Sure is...

...<your normal search>...
| inputlookup append=true domains.csv
| ...

 

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...