I am trying to write a search where I pull data from a lookup table where one field in the lookup matches the value entered by user in a text field.
For example, user enters a user name in a text field on dashboard then clicks submit button.
I want to display data (row) from a lookup table where the user name entered by the user matches a field (column) in the lookup. In my case the lookup contains data pulled from ldap.
I have tried the following but it does not return any data. But I know there is a row in my lookup that matches what I am entering in the text box.
| lookup ldap_data.csv identity as $username$ OUTPUTNEW first last email bunit startDate
the problem with your
| lookup ldap_data.csv identity as $username$ OUTPUTNEW first last email unit startDate in the dashboard is, that it translates into this
| lookup ldap_data.csv identity as foo OUTPUTNEW first last email unit startDate in the end and
foo is expected to be a field not a value. Therefore you need to
create a dummy field first and use this in the
Take this run everywhere example (Note: this works on Splunk 6.3 after you created the Lookup definitions called
car_data using the provided
<form> <label>lookup with textbox</label> <fieldset submitButton="false"> <input type="text" token="field1"> <label>Enter text to search:</label> </input> </fieldset> <row> <panel> <table> <search> <query>|stats count | eval myFoo=$field1$ | lookup car_data.csv speed AS myFoo | fields - count</query> <earliest>@d</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form>
This will take the value form the textbook, use it in the eval to create the dummy speed field and run the lookup against it.
Hope this helps ...