Search results to lookup table

[mwdbhyat]

Hi,

I am currently running a search in a custom app that finds sourcetypes by number of hosts:
- | tstats dc(host) as "Number of Hosts" where index=test* by sourcetype

Id like to know how to:
- Convert the results to a lookup table
- Edit the lookup table when required in the UI - Would I be able to use the lookup app within my custom app?

Thanks!

[renjith_nair · Accepted solution]

You can use outputlookup to store and modify data

See here : http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Outputlookup

[mwdbhyat]

Thanks - I should probably have mentioned that I need this information to display in the table on the dashboard where my search results currently get displayed.. So im guessing ill just set up a saved search to output the file to csv and update it daily, then on the dashboard use an inputlookup search to display the results..

My next task is to the somehow create a way to manually edit the lookup on the dashboard when required..I know there is a lookup app, any thoughts on how I could integrate this into my dashboard within my app?

[renjith_nair]

If you want to use another app, you need to create a link to the other app(even drill down works) from your dashboard or merge the artifacts of the apps.

Alternatively , you can KVstore lookup and create your own dashboards to edit or amend. Please see this example with all operations on a KVStore : http://dev.splunk.com/view/webframework-tutorials/SP-CAAAEZT