Splunk Search

Is it possible to set a token using a field found in a lookup without drilldown?

Path Finder

Can I set a token using a field found in a lookup table? I've been researching online, but I haven't found a real solution. Thanks in advanced for any help

1 Solution

Legend

Yes you can. The online documentation has a few examples showing use of token for things other than drill-down. There's one on dynamic display of elements. What specifically are you looking for?

http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/tokens

View solution in original post

Legend

Yes you can. The online documentation has a few examples showing use of token for things other than drill-down. There's one on dynamic display of elements. What specifically are you looking for?

http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/tokens

View solution in original post

Path Finder

Thanks that's helpful. I was looking to set the outputed ID to the token $ID$

    <title>Lookup customer</title>
    <searchString>index = foo | head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT ID</searchString> 
0 Karma

Legend

Do you not see the value of the token pass in?

Path Finder

Yes I can see the value. But I don't know how to pass a value to a token inside a search.

I've tried to implement your example like this, but it isn't working.

    <searchString>index = foo| head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT  ID ect ect ect | rename ect as "blah"| transpose</searchString>
    <earliestTime>-60m@m</earliestTime>
    <latestTime>now</latestTime>
    <progress>
      <condition match="'job.resultCount' ==*">
        <set token="ID">$row.ID$</set>
      </condition>
      <condition match="'job.resultCount' !=*">
        <set token="ID">$row.ID$</set>
      </condition>
      <change>
         <set token="ID">$row.ID$</set>
      </change>
   </progress>
0 Karma

Path Finder

I've come to the conclusin that this isn't possbile in my version of splunk (6.1). I think it's possible in 6.2 or later. You need to put the progress or change options inside search and query objects like in by sundareshr's answer

0 Karma

Splunk Employee
Splunk Employee

Just to clarify, there are a few things that will not work in the above xml code:

  • searchString/earliestTime/latestTime is legacy syntax for search
  • is a new event handler introduced in Splunk 6.3
  • event handler is only supported within form inputs
  • is only available for drilldown

So based on the above, here's what it should really look like:

<search>

   <query>index = foo| head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT  ID ect ect ect | rename ect as "blah"| transpose</query>
   <earliest>-60m@m</earliest>
   <latest>now</latest>

   <progress> 
      <set token="ID">$result.ID$</set>
   </progress>

<search>
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!