Splunk Search

Is it possible to use a token variable in a search to output a lookup table value?

jravida
Communicator

Hey folks,

I had an idea, but am not sure if it can be done in Splunk. I want have a dashboard where you can enter text (such as an IP) into a search, and pass that token to a lookup table (of, say, CIDR blocks my company uses, and the name/label we've named the CIDR block, like N Main, Huntington, etc ) and it would output that name of section of the network the IP originates.

Where I think it will fail is that there is no index I am searching on. I just want it to bounce the IP off of the CIDR blocks we have in the lookup table, and output the name. Thanks in advance for your help.

Edit: I should mention that I have CIDR block lookup working for normal searches.

Tags (2)
1 Solution

lguinn2
Legend

It should work fine. The simple XML might look like this:

<form>
  <label>Sample search</label>
  <searchTemplate>index = main | head 1 | eval IP="$IP_input$"
                  | lookup yourLookupName lookupFieldName as IP OUTPUT outputFieldName
       </searchTemplate>
  <fieldset>
      <input type="text" token="IP_input" />
  </fieldset>
  <row>
      <table>
            <title>Results</title>
            <option name="count">10</option>
      </table>
  </row>
</form>

You can actually start a searchTemplate with a | lookup ... but that won't work here, because you need to get the user's input into a variable. So I included a "dummy search" that just looks at the main index and pulls the first event it finds - and then ignores it.

View solution in original post

lguinn2
Legend

It should work fine. The simple XML might look like this:

<form>
  <label>Sample search</label>
  <searchTemplate>index = main | head 1 | eval IP="$IP_input$"
                  | lookup yourLookupName lookupFieldName as IP OUTPUT outputFieldName
       </searchTemplate>
  <fieldset>
      <input type="text" token="IP_input" />
  </fieldset>
  <row>
      <table>
            <title>Results</title>
            <option name="count">10</option>
      </table>
  </row>
</form>

You can actually start a searchTemplate with a | lookup ... but that won't work here, because you need to get the user's input into a variable. So I included a "dummy search" that just looks at the main index and pulls the first event it finds - and then ignores it.

jravida
Communicator

Awesome! Great workaround. I was sooooo close!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...