Splunk Search

how can you search a lookup table for a value entered in a text box?

darlas
Communicator

I am trying to write a search where I pull data from a lookup table where one field in the lookup matches the value entered by user in a text field.

For example, user enters a user name in a text field on dashboard then clicks submit button.

I want to display data (row) from a lookup table where the user name entered by the user matches a field (column) in the lookup. In my case the lookup contains data pulled from ldap.

I have tried the following but it does not return any data. But I know there is a row in my lookup that matches what I am entering in the text box.

| lookup ldap_data.csv identity as $username$ OUTPUTNEW first last email bunit startDate

Any ideas?

Thanks!

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi darlas,

the problem with your | lookup ldap_data.csv identity as $username$ OUTPUTNEW first last email unit startDate in the dashboard is, that it translates into this | lookup ldap_data.csv identity as foo OUTPUTNEW first last email unit startDate in the end and foo is expected to be a field not a value. Therefore you need to create a dummy field first and use this in the lookup.

Take this run everywhere example (Note: this works on Splunk 6.3 after you created the Lookup definitions called car_data using the provided car_data.csv:

<form>
  <label>lookup with textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>Enter text to search:</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>|stats count | eval myFoo=$field1$ | lookup car_data.csv speed AS myFoo | fields - count</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

This will take the value form the textbook, use it in the eval to create the dummy speed field and run the lookup against it.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi darlas,

the problem with your | lookup ldap_data.csv identity as $username$ OUTPUTNEW first last email unit startDate in the dashboard is, that it translates into this | lookup ldap_data.csv identity as foo OUTPUTNEW first last email unit startDate in the end and foo is expected to be a field not a value. Therefore you need to create a dummy field first and use this in the lookup.

Take this run everywhere example (Note: this works on Splunk 6.3 after you created the Lookup definitions called car_data using the provided car_data.csv:

<form>
  <label>lookup with textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>Enter text to search:</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>|stats count | eval myFoo=$field1$ | lookup car_data.csv speed AS myFoo | fields - count</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

This will take the value form the textbook, use it in the eval to create the dummy speed field and run the lookup against it.

Hope this helps ...

cheers, MuS

darlas
Communicator

Thanks for the quick and successful solution!

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...