Splunk Search

Lookup Editor: Can I open a specific lookup file from a link in my dashboard?

actionabledata
Path Finder

Hello All,

I am wanting to create a user-defined "dictionary" for a dashboard and would desire for the user to click on a link within the dashboard to launch the Lookup Editor app on a specific *.csv file. I would seed the dictionary with specific columns. 

Is this possible?

I tried something like the following but got an error ... "The lookup could not be loaded from the server"

         <drilldown>          
           <link>
                http://myServer:8000/en-US/app/lookup_editor/lookup_edit?owner=nobody&amp;namespace=myAppName&amp;type=csv&amp;Name=client_information.csv
           </link>
         </drilldown>

 Appreciate the help.

 

Labels (1)
Tags (2)
0 Karma

shivanshu1593
Builder

Edit the namespace value with the actual value as per your environment and add the value for transforms (If available for the lookup or leave it blank)

 

<option name="list.drilldown">full</option>
<drilldown>
    <link target="_blank">http://myServer:8000/en-US/app/lookup_editor/lookup_edit?owner=nobody&namespace=myAppName&lookup=client_information.csv&type=csv&transform=</link>
</drilldown>

 

###If it helped, kindly consider an upvote/accepting as answer###

 

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...