Splunk Search
Highlighted

Why can't I push my data to a lookup table from a button?

Motivator

Hi,

I am trying to push data to a lookup table from a button.

   <html>
        <button class="btn" data-token-json="{&quot;|index=main | head 1 | table _time | outputlookup JMAP_BUTTON.csv&quot;}">JMAP_HISTO</button>
      </html>

But nothing is happening... not sure

As i have a more complex example and it works there:

 <html>
        <button class="btn" data-token-json="{&quot;execute_save_test&quot;:&quot;| eventstats max(ID) as max_ID | eval ID = if(isnull(ID),max_ID + 1,ID) | fields - max_ID | dedup ID | outputlookup Saved_Tests.csv&quot;, &quot;saved_test&quot;: true}">Save new test</button>
      </html>
0 Karma
Highlighted

Re: Why can't I push my data to a lookup table from a button?

Influencer

Does your look up have field with name _time?

0 Karma
Highlighted

Re: Why can't I push my data to a lookup table from a button?

Motivator

sorry for delay.

I can run the command form SPL and it works fine for me

|index=main | head 1 | table time | outputlookup JMAPBUTTON.csv

I can open the .csv file and i can see it is updated correctly.
The issues is getting it to run when i press the button, am i missing something?

0 Karma
Highlighted

Re: Why can't I push my data to a lookup table from a button?

Builder

There is no command named index. So you aren't doing "| index=foo" in SPL, you're dropping the pipe. The details between the examples is not 1 for 1. You're complex example starts with {&quot;execute_save_test&quot;:&quot;
and ends &quot;, &quot;saved_test&quot;: true}.
I would double check your syntax between your examples. I tried to reproduce both examples and neither worked for me.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Why can't I push my data to a lookup table from a button?

Champion

Try removing | before index=main

0 Karma
Highlighted

Re: Why can't I push my data to a lookup table from a button?

Motivator

Thanks, but this did not work, i posted an answer.

0 Karma
Highlighted

Re: Why can't I push my data to a lookup table from a button?

Esteemed Legend

I agree with @p_gurav; remove the pipe ( | ) before | index=main. That should do it.

0 Karma
Highlighted

Re: Why can't I push my data to a lookup table from a button?

Motivator

Woodcock - happy new year 🙂 Thanks for info, but this did not work, i posed an answer.

0 Karma
Highlighted

Re: Why can't I push my data to a lookup table from a button?

Motivator

Hi

I think i got to the bottom of this.

So i think it is not possible to run this query from a button, this is why it was not working.
It is possible to set a token `(SETTOKENTOBEUSED) from the button and then use that token in a query that will re-run when the token is set and giving the effect that the button is working.

For Example - I set my token to the SPL of what i want SETTOKENTOBEUSED

<html>
         <button class="btn" data-token-json="{&quot;SET_TOKEN_TO_BE_USED&quot;:&quot;| SPL_THAT_I_WANT_TO_RUN_WHEN_BOTTON_IS_PRESSED&quot;: true}">DEMO_BUTTON</button>
       </html>

NEW QUERY (That will run when SETTOKENTOBEUSED is updated)

  <table depends="$never_show$">
        <search>
          <query>
                                                                                                                                            $SET_TOKEN_TO_BE_USED$</query>
          <done>

          </done>
        </search>
      </table>

I will 100% apply this solution and get back with an update

Rob

View solution in original post

Highlighted

Re: Why can't I push my data to a lookup table from a button?

Splunk Employee
Splunk Employee

Did this work? @robertlynch2020

0 Karma