I initialize a lookup file using:
| makeresults
| outputlookup status.csv
I then have this simple search:
| inputlookup status.csv
| eval a=if(isnull(a),1,a+1)
| outputlookup status.csv
This works fine when I run it in Search. The "a" value gets incremented each time the search is executed.
But if I put the same thing in a dashboard it results in an error and does not update the lookup table.
In a classic dashboard, the panel with this search just says "Search was cancelled".
In dashboard studio, a panel with this search as its data source reports this error: "Unexpected non-whitespace character after JSON at position 4"
Removing the outputlookup command in either case makes the search work, and it shows an up-to-date value for "a" (given how many times the search was executed in Search).
I have no clue what I'm doing wrong with what seems like such a simple thing - really hoping someone can help me!
Are you running a multi-search-head environment?
I have found that updates to csv are not instantaneous, so is there perhaps a lag between the outputlookup and inputlookup?
Hi @johnjester,
I used outputlookup in a Classic dashboard and it runs without errors.
The only issue is that the lookup is updated at every dashboard reload.
I didn't tried with Dashboard Studio, but it should be the same thing.
Maybe there something else.
Ciao.
Giuseppe