Splunk Search

Is it possible to use a token variable in a search to output a lookup table value?

jravida
Communicator

Hey folks,

I had an idea, but am not sure if it can be done in Splunk. I want have a dashboard where you can enter text (such as an IP) into a search, and pass that token to a lookup table (of, say, CIDR blocks my company uses, and the name/label we've named the CIDR block, like N Main, Huntington, etc ) and it would output that name of section of the network the IP originates.

Where I think it will fail is that there is no index I am searching on. I just want it to bounce the IP off of the CIDR blocks we have in the lookup table, and output the name. Thanks in advance for your help.

Edit: I should mention that I have CIDR block lookup working for normal searches.

Tags (2)
1 Solution

lguinn2
Legend

It should work fine. The simple XML might look like this:

<form>
  <label>Sample search</label>
  <searchTemplate>index = main | head 1 | eval IP="$IP_input$"
                  | lookup yourLookupName lookupFieldName as IP OUTPUT outputFieldName
       </searchTemplate>
  <fieldset>
      <input type="text" token="IP_input" />
  </fieldset>
  <row>
      <table>
            <title>Results</title>
            <option name="count">10</option>
      </table>
  </row>
</form>

You can actually start a searchTemplate with a | lookup ... but that won't work here, because you need to get the user's input into a variable. So I included a "dummy search" that just looks at the main index and pulls the first event it finds - and then ignores it.

View solution in original post

lguinn2
Legend

It should work fine. The simple XML might look like this:

<form>
  <label>Sample search</label>
  <searchTemplate>index = main | head 1 | eval IP="$IP_input$"
                  | lookup yourLookupName lookupFieldName as IP OUTPUT outputFieldName
       </searchTemplate>
  <fieldset>
      <input type="text" token="IP_input" />
  </fieldset>
  <row>
      <table>
            <title>Results</title>
            <option name="count">10</option>
      </table>
  </row>
</form>

You can actually start a searchTemplate with a | lookup ... but that won't work here, because you need to get the user's input into a variable. So I included a "dummy search" that just looks at the main index and pulls the first event it finds - and then ignores it.

jravida
Communicator

Awesome! Great workaround. I was sooooo close!

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...