Hello ! Need your help splunkers ! I want to append or create a csv for each rows of my query 🙂 I do this for assignate the fields to the file_name  :    | .. query | foreach * [ | eval customer_name = if("<<FIELD>>" = "nom_site", "DATA_".'<<FIELD>>'.".csv", "Error") | outputlookup append=true customer_name ]   Error in 'outputlookup' command: The lookup table 'customer_name' is invalid.  (I try with $customer_name$ and $customer_name too). And I do a second try like this, with a lookup search:    | ... query | foreach * [ | eval customer_name = if("<<FIELD>>" = "nom_site", '<<FIELD>>', "Error") | outputlookup append=true [| inputlookup customers.csv | search name=customer_name | eval name_file = "DATA_".name.".csv" | return $name_file)] ]    Error : Error in 'outputlookup' command: A lookup table name or file name is required. And finaly, I do with a call of a macro (who contains the precedent lookup search)  :    | ... query | foreach * [ | eval customer_name = if("<<FIELD>>" = "nom_site", '<<FIELD>>', "Error") | outputlookup append=true `name_to_csv(customer_name)` ]     Thanks for your help. Have a  nice day 🙂 ... View more

Hi everybody ! I have a map with points, with values : long, lat and the name of the city 🙂 When the user click of a point i open a dashboard with the name of the city ($click.name2$) clicked But for the all points the value of click.name 2 are the same 😕 whereas when I fly over the dots, the names are quite different. I try everything with $click.name$, $click.name2$,  or $click.value$,  $click.value2$, I do this :      <link target="_blank">/app/dashboard_?name=$click.name2$</link>     With this query for the map :   . . . . . | geostats latfield=latitude_dgr longfield=longitude_dgr count by name    Thanksss 🙂 ... View more

Hello everybody ! I'm new in Splunk dev and I can not do a query in my drilldown :// I have a map, and i want to do a query with the click name for get data from a lookup and after go to my dashboard with this 2 tokens in params. So : click, get data thx to the click name, go to dashboard with data and click in params in the URL Like this :        <drilldown> <set token="TOKEN">| inputlookup lookup_name.csv | search name = $click.name$ | fields nbr</set> <link target="_blank">/app/dashboard_$TOKEN$ nom_site=$click.name$</link> </drilldown>      Thx a lot ! ... View more

Hello everyone, I'm a new in your community, thank you for the welcome 🙂 I need to display a map with several fields for each data. I had done this for display with a single data (it works!)       | inputlookup data.csv | search agence_rattachement="*" AND code_client_groupe=* AND nom_site=* AND id_departement=* | lookup villes_france.csv nom_reel AS ville_site OUTPUTNEW longitude_dgr,latitude_dgr | lookup data-2.csv nom_site_rattachement AS nom_site OUTPUTNEW nombre_compresseur, numero_centrale | geostats latfield=latitude_dgr longfield=longitude_dgr count by nom_site       But with a multitude of fields, it no longer works:/ I have the data (see in picture) but the map contains no points:       | inputlookup data.csv | search agence_rattachement="*" AND code_client_groupe=* AND nom_site=* AND id_departement=* | lookup villes_france.csv nom_reel AS ville_site OUTPUTNEW longitude_dgr,latitude_dgr | lookup data_2.csv nom_site_rattachement AS nom_site OUTPUTNEW nombre_compresseur, numero_centrale | geostats latfield=latitude_dgr longfield=longitude_dgr translatetoxy=false count by nom_site       Thx you !!!! Have a good day ... View more