Splunk Search

query help inputlookup map

surekhasplunk
Communicator
| rest /services/authentication/users splunk_server=local 
| search 
    [| rest /services/authentication/current-context 
    | rename username as title 
    | fields title] 
| eval title=upper(title) 
| lookup employeeinfo.csv RACF_ID as title output EMPLOYEE_FULL_NAME 
| lookup rolesnames.csv "Delivery Manager" as EMPLOYEE_FULL_NAME output "Delivery Area" as area 
| where EMPLOYEE_FULL_NAME="abcd" 
| map 
    [| inputlookup EPerformanceData.csv 
    | search "Sub Division 6"="$area$" 
    | stats count  by "Sub Division 5" 
    | eval "% Completed"=((Completed/'Total to be Complete')*100) 
    | eval "% Completed"=round('% Completed',2) 
    | rename "Sub Division 5" as "Business Area"]

This patch of code works well. Now my requirement is i need to add once more inpulookupfile saying dates.csv which i need to use in this query like |inpulookup dates.csv |search Quarter=$quarter$ and here the $quarter$` values comes from the selected dropdown.

But where ever i try to include the above line of code either i get error or my previous tokens like area doesn't get the required value.
So please help me with thequery.

Thanks

Tags (3)
0 Karma

rlalwani_splunk
Splunk Employee
Splunk Employee

Try to use |inpulookup dates.csv where Quarter="$quarter$", might be the token value is set to empty and the replacement causes an syntax error in the query, so enclose the token value in double quotes.

0 Karma

ppatrikfr
Path Finder

Did you try to add token's value in an eval and try to call it on your new inputlookup by eval?

0 Karma

ppatrikfr
Path Finder

Let me explaine better, In my mind you are trying to do this "| Join [|inpulookup dates.csv |search Quarter=$quarter$]", if your "$quarter$" did not work try "| eval quarterValue="$quarter$"" and then "| Join [|inpulookup dates.csv |search Quarter=quarterValue]"

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...