Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Why can't I push my data to a lookup table from a ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I am trying to push data to a lookup table from a button.
<html>
<button class="btn" data-token-json="{"|index=main | head 1 | table _time | outputlookup JMAP_BUTTON.csv"}">JMAP_HISTO</button>
</html>
But nothing is happening... not sure
As i have a more complex example and it works there:
<html>
<button class="btn" data-token-json="{"execute_save_test":"| eventstats max(ID) as max_ID | eval ID = if(isnull(ID),max_ID + 1,ID) | fields - max_ID | dedup ID | outputlookup Saved_Tests.csv", "saved_test": true}">Save new test</button>
</html>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I think i got to the bottom of this.
So i think it is not possible to run this query from a button, this is why it was not working.
It is possible to set a token `(SET_TOKEN_TO_BE_USED) from the button and then use that token in a query that will re-run when the token is set and giving the effect that the button is working.
For Example - I set my token to the SPL of what i want SET_TOKEN_TO_BE_USED
<html>
<button class="btn" data-token-json="{"SET_TOKEN_TO_BE_USED":"| SPL_THAT_I_WANT_TO_RUN_WHEN_BOTTON_IS_PRESSED": true}">DEMO_BUTTON</button>
</html>
NEW QUERY (That will run when SET_TOKEN_TO_BE_USED is updated)
<table depends="$never_show$">
<search>
<query>
$SET_TOKEN_TO_BE_USED$</query>
<done>
</done>
</search>
</table>
I will 100% apply this solution and get back with an update
Rob
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I think i got to the bottom of this.
So i think it is not possible to run this query from a button, this is why it was not working.
It is possible to set a token `(SET_TOKEN_TO_BE_USED) from the button and then use that token in a query that will re-run when the token is set and giving the effect that the button is working.
For Example - I set my token to the SPL of what i want SET_TOKEN_TO_BE_USED
<html>
<button class="btn" data-token-json="{"SET_TOKEN_TO_BE_USED":"| SPL_THAT_I_WANT_TO_RUN_WHEN_BOTTON_IS_PRESSED": true}">DEMO_BUTTON</button>
</html>
NEW QUERY (That will run when SET_TOKEN_TO_BE_USED is updated)
<table depends="$never_show$">
<search>
<query>
$SET_TOKEN_TO_BE_USED$</query>
<done>
</done>
</search>
</table>
I will 100% apply this solution and get back with an update
Rob
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did this work? @robertlynch2020
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree with @p_gurav; remove the pipe ( | ) before | index=main. That should do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Woodcock - happy new year 🙂 Thanks for info, but this did not work, i posed an answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try removing | before index=main
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, but this did not work, i posted an answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does your look up have field with name _time?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sorry for delay.
I can run the command form SPL and it works fine for me
|index=main | head 1 | table _time | outputlookup JMAP_BUTTON.csv
I can open the .csv file and i can see it is updated correctly.
The issues is getting it to run when i press the button, am i missing something?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no command named index. So you aren't doing "| index=foo" in SPL, you're dropping the pipe. The details between the examples is not 1 for 1. You're complex example starts with {"execute_save_test":"
and ends ", "saved_test": true}.
I would double check your syntax between your examples. I tried to reproduce both examples and neither worked for me.
If this reply helps you, an upvote would be appreciated.
Accelerating Observability as Code with the Splunk AI Assistant
Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...
Congratulations to the 2025-2026 SplunkTrust!
