how can you search a lookup table for a value entered in a text box?

[darlas]

I am trying to write a search where I pull data from a lookup table where one field in the lookup matches the value entered by user in a text field.

For example, user enters a user name in a text field on dashboard then clicks submit button.

I want to display data (row) from a lookup table where the user name entered by the user matches a field (column) in the lookup. In my case the lookup contains data pulled from ldap.

I have tried the following but it does not return any data. But I know there is a row in my lookup that matches what I am entering in the text box.

| lookup ldap_data.csv identity as $username$ OUTPUTNEW first last email bunit startDate

Any ideas?

Thanks!

[MuS · Accepted solution]

Hi darlas,

the problem with your | lookup ldap_data.csv identity as $username$ OUTPUTNEW first last email unit startDate in the dashboard is, that it translates into this | lookup ldap_data.csv identity as foo OUTPUTNEW first last email unit startDate in the end and foo is expected to be a field not a value. Therefore you need to create a dummy field first and use this in the lookup.

Take this run everywhere example (Note: this works on Splunk 6.3 after you created the Lookup definitions called car_data using the provided car_data.csv:

<form>
  <label>lookup with textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>Enter text to search:</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>|stats count | eval myFoo=$field1$ | lookup car_data.csv speed AS myFoo | fields - count</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

This will take the value form the textbook, use it in the eval to create the dummy speed field and run the lookup against it.

Hope this helps ...

cheers, MuS

[darlas]

Thanks for the quick and successful solution!