Splunk Search

Why can't I push my data to a lookup table from a button?

Motivator

Hi,

I am trying to push data to a lookup table from a button.

   <html>
        <button class="btn" data-token-json="{&quot;|index=main | head 1 | table _time | outputlookup JMAP_BUTTON.csv&quot;}">JMAP_HISTO</button>
      </html>

But nothing is happening... not sure

As i have a more complex example and it works there:

 <html>
        <button class="btn" data-token-json="{&quot;execute_save_test&quot;:&quot;| eventstats max(ID) as max_ID | eval ID = if(isnull(ID),max_ID + 1,ID) | fields - max_ID | dedup ID | outputlookup Saved_Tests.csv&quot;, &quot;saved_test&quot;: true}">Save new test</button>
      </html>
0 Karma
1 Solution

Motivator

Hi

I think i got to the bottom of this.

So i think it is not possible to run this query from a button, this is why it was not working.
It is possible to set a token `(SET_TOKEN_TO_BE_USED) from the button and then use that token in a query that will re-run when the token is set and giving the effect that the button is working.

For Example - I set my token to the SPL of what i want SET_TOKEN_TO_BE_USED

<html>
         <button class="btn" data-token-json="{&quot;SET_TOKEN_TO_BE_USED&quot;:&quot;| SPL_THAT_I_WANT_TO_RUN_WHEN_BOTTON_IS_PRESSED&quot;: true}">DEMO_BUTTON</button>
       </html>

NEW QUERY (That will run when SET_TOKEN_TO_BE_USED is updated)

  <table depends="$never_show$">
        <search>
          <query>
                                                                                                                                            $SET_TOKEN_TO_BE_USED$</query>
          <done>

          </done>
        </search>
      </table>

I will 100% apply this solution and get back with an update

Rob

View solution in original post

Motivator

Hi

I think i got to the bottom of this.

So i think it is not possible to run this query from a button, this is why it was not working.
It is possible to set a token `(SET_TOKEN_TO_BE_USED) from the button and then use that token in a query that will re-run when the token is set and giving the effect that the button is working.

For Example - I set my token to the SPL of what i want SET_TOKEN_TO_BE_USED

<html>
         <button class="btn" data-token-json="{&quot;SET_TOKEN_TO_BE_USED&quot;:&quot;| SPL_THAT_I_WANT_TO_RUN_WHEN_BOTTON_IS_PRESSED&quot;: true}">DEMO_BUTTON</button>
       </html>

NEW QUERY (That will run when SET_TOKEN_TO_BE_USED is updated)

  <table depends="$never_show$">
        <search>
          <query>
                                                                                                                                            $SET_TOKEN_TO_BE_USED$</query>
          <done>

          </done>
        </search>
      </table>

I will 100% apply this solution and get back with an update

Rob

View solution in original post

Splunk Employee
Splunk Employee

Did this work? @robertlynch2020

0 Karma

Esteemed Legend

I agree with @p_gurav; remove the pipe ( | ) before | index=main. That should do it.

0 Karma

Motivator

Woodcock - happy new year 🙂 Thanks for info, but this did not work, i posed an answer.

0 Karma

Champion

Try removing | before index=main

0 Karma

Motivator

Thanks, but this did not work, i posted an answer.

0 Karma

Influencer

Does your look up have field with name _time?

0 Karma

Motivator

sorry for delay.

I can run the command form SPL and it works fine for me

|index=main | head 1 | table _time | outputlookup JMAP_BUTTON.csv

I can open the .csv file and i can see it is updated correctly.
The issues is getting it to run when i press the button, am i missing something?

0 Karma

Builder

There is no command named index. So you aren't doing "| index=foo" in SPL, you're dropping the pipe. The details between the examples is not 1 for 1. You're complex example starts with {&quot;execute_save_test&quot;:&quot;
and ends &quot;, &quot;saved_test&quot;: true}.
I would double check your syntax between your examples. I tried to reproduce both examples and neither worked for me.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!