- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Why can't I push my data to a lookup table fro...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I am trying to push data to a lookup table from a button.
<html>
<button class="btn" data-token-json="{"|index=main | head 1 | table _time | outputlookup JMAP_BUTTON.csv"}">JMAP_HISTO</button>
</html>
But nothing is happening... not sure
As i have a more complex example and it works there:
<html>
<button class="btn" data-token-json="{"execute_save_test":"| eventstats max(ID) as max_ID | eval ID = if(isnull(ID),max_ID + 1,ID) | fields - max_ID | dedup ID | outputlookup Saved_Tests.csv", "saved_test": true}">Save new test</button>
</html>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I think i got to the bottom of this.
So i think it is not possible to run this query from a button, this is why it was not working.
It is possible to set a token `(SET_TOKEN_TO_BE_USED) from the button and then use that token in a query that will re-run when the token is set and giving the effect that the button is working.
For Example - I set my token to the SPL of what i want SET_TOKEN_TO_BE_USED
<html>
<button class="btn" data-token-json="{"SET_TOKEN_TO_BE_USED":"| SPL_THAT_I_WANT_TO_RUN_WHEN_BOTTON_IS_PRESSED": true}">DEMO_BUTTON</button>
</html>
NEW QUERY (That will run when SET_TOKEN_TO_BE_USED is updated)
<table depends="$never_show$">
<search>
<query>
$SET_TOKEN_TO_BE_USED$</query>
<done>
</done>
</search>
</table>
I will 100% apply this solution and get back with an update
Rob
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I think i got to the bottom of this.
So i think it is not possible to run this query from a button, this is why it was not working.
It is possible to set a token `(SET_TOKEN_TO_BE_USED) from the button and then use that token in a query that will re-run when the token is set and giving the effect that the button is working.
For Example - I set my token to the SPL of what i want SET_TOKEN_TO_BE_USED
<html>
<button class="btn" data-token-json="{"SET_TOKEN_TO_BE_USED":"| SPL_THAT_I_WANT_TO_RUN_WHEN_BOTTON_IS_PRESSED": true}">DEMO_BUTTON</button>
</html>
NEW QUERY (That will run when SET_TOKEN_TO_BE_USED is updated)
<table depends="$never_show$">
<search>
<query>
$SET_TOKEN_TO_BE_USED$</query>
<done>
</done>
</search>
</table>
I will 100% apply this solution and get back with an update
Rob
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did this work? @robertlynch2020
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree with @p_gurav; remove the pipe ( | ) before | index=main. That should do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Woodcock - happy new year 🙂 Thanks for info, but this did not work, i posed an answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try removing | before index=main
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, but this did not work, i posted an answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does your look up have field with name _time?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sorry for delay.
I can run the command form SPL and it works fine for me
|index=main | head 1 | table _time | outputlookup JMAP_BUTTON.csv
I can open the .csv file and i can see it is updated correctly.
The issues is getting it to run when i press the button, am i missing something?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no command named index. So you aren't doing "| index=foo" in SPL, you're dropping the pipe. The details between the examples is not 1 for 1. You're complex example starts with {"execute_save_test":"
and ends ", "saved_test": true}.
I would double check your syntax between your examples. I tried to reproduce both examples and neither worked for me.
If this reply helps you, an upvote would be appreciated.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
