Splunk Search

Limiting lookup options using a token

ft_kd02
Path Finder

Hi all,

I have a lookup and I'd like to filter based on tokenized value. The lookup dropdown also sets a different token based on selection. This would normally be a simple task, but I've been asked to have the lookup pre-filtered based on who is using the app. Each item in the dropdown represents a different user. 

The lookup:

| inputlookup $tokLookup$
| fields field_description, field
| dedup field,field_description

field for label = field_description
field for value = field

The pseudo code of what I'd like to do is simple:

| inputlookup $tokLookup$
| where field="$tokUserRole$"
| fields field_description, field
| dedup field,field_description

Is this possible within the constraints, such that I'm only producing the single value from the lookup corresponding to the user?

Labels (1)
0 Karma
1 Solution

ft_kd02
Path Finder

Turned out to be a issue in how the data was handled before it hit the token and when the token was populated. The above solution should work:

| inputlookup $tokLookup$
| where field="$tokUserRole$"
| fields field_description, field
| dedup field,field_description

 

 

View solution in original post

0 Karma

ft_kd02
Path Finder

Turned out to be a issue in how the data was handled before it hit the token and when the token was populated. The above solution should work:

| inputlookup $tokLookup$
| where field="$tokUserRole$"
| fields field_description, field
| dedup field,field_description

 

 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...