Splunk Search

Search results to lookup table

Builder

Hi,

I am currently running a search in a custom app that finds sourcetypes by number of hosts:
- | tstats dc(host) as "Number of Hosts" where index=test* by sourcetype

Id like to know how to:
- Convert the results to a lookup table
- Edit the lookup table when required in the UI - Would I be able to use the lookup app within my custom app?

Thanks!

0 Karma
1 Solution

SplunkTrust
SplunkTrust
0 Karma

SplunkTrust
SplunkTrust
0 Karma

Builder

Thanks - I should probably have mentioned that I need this information to display in the table on the dashboard where my search results currently get displayed.. So im guessing ill just set up a saved search to output the file to csv and update it daily, then on the dashboard use an inputlookup search to display the results..

My next task is to the somehow create a way to manually edit the lookup on the dashboard when required..I know there is a lookup app, any thoughts on how I could integrate this into my dashboard within my app?

0 Karma

SplunkTrust
SplunkTrust

If you want to use another app, you need to create a link to the other app(even drill down works) from your dashboard or merge the artifacts of the apps.

Alternatively , you can KVstore lookup and create your own dashboards to edit or amend. Please see this example with all operations on a KVStore : http://dev.splunk.com/view/webframework-tutorials/SP-CAAAEZT

0 Karma