Splunk Search

Lookup Table search wildcards

balcv
Contributor

I have created a lookup table, service.csv

host,service,resource
"host1","fdl","all"
"host2","finance","db"
"host3","campus","web"
"host4","finance","db"
"host5","finance","db"
"host6","finance","app"
"host7","finance","app"

I have created a dashboard with 2 inputs, service and resource, which are both dropdown lists with various options in each, but also with an ALL option with a value of *.

The search linked to this dashboard is as follows:

index="*" source="*secure" ("keyboard")
| lookup "service.csv" host OUTPUT host,service,resource 
| where service="$service$" AND resource="$resource$"
| table service,resource,host,source,_raw | sort -_raw

When I select a specific service and a specific resource from the dropdown lists, the search returns the desired results from both the lookup table and the data source. However, when I select the ALL (*) option for either or both lists, it get no results returned.

The search looks like:

index="*" source="*secure" ("keyboard")
| lookup "service.csv" host OUTPUT host,service,resource 
| where service="*" AND resource="*"
| table service,resource,host,source,_raw | sort -_raw

Is there a way to resolve this so that I get return the desired results.

0 Karma
1 Solution

nareshinsvu
Builder

How about using search(without AND operator) instead of where?

| search service="*"  resource="*"

View solution in original post

nareshinsvu
Builder

How about using search(without AND operator) instead of where?

| search service="*"  resource="*"

balcv
Contributor

Sooooo simple!!. Thank you.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...