Hi,
I like to setup a kind of help-text library based on unique msgcode-xx.csv text files. (or internal/external tml pages/files)
With the code beneath I try to look for a filename in EVENTLIST_3v3 that I can use as an input for an appended inputlookup statement. Lookup goes ok, but I can not get it passed further as a filename argument for the next inputlookup statement.
Nb. the filename is stored in the EVENTLIST_3v3 .
What ever I tried nothing works sofar and I do not understand why a correct filename string can not be processed as parameter of a following (append,join etc) inputlookup command.
| makeresults
| eval msgtxt="46 - No intervention needed" , msgcode=substr(msgtxt,0,2) | table msgcode
| lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc
| table helpdoc
| appendcols
[|inputlookup helpdoc | table *]
regards
Ashley Pietersen
I do it like this on a dashboard:
| lookup
[
| makeresults count=1
| eval env="$VARIABLE_FROM_DROPDOWN$"
| eval lookupname=case
(
match(env,"prod.*"), "prod",
match(env,"uat.*"), "uat",
match(env,"qa.*"), "qa"
)
| fields lookupname
| return $lookupname
] fieldInLookup AS fieldInData OUTPUTNEW fieldsFromLookup
So to adapt it for your use case i think this would work:
|inputlookup
[
| makeresults
| eval msgtxt="46 - No intervention needed" , msgcode=substr(msgtxt,0,2)
| table msgcode
| lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc
| fields helpdoc
| return $helpdoc
] | table *
I do it like this on a dashboard:
| lookup
[
| makeresults count=1
| eval env="$VARIABLE_FROM_DROPDOWN$"
| eval lookupname=case
(
match(env,"prod.*"), "prod",
match(env,"uat.*"), "uat",
match(env,"qa.*"), "qa"
)
| fields lookupname
| return $lookupname
] fieldInLookup AS fieldInData OUTPUTNEW fieldsFromLookup
So to adapt it for your use case i think this would work:
|inputlookup
[
| makeresults
| eval msgtxt="46 - No intervention needed" , msgcode=substr(msgtxt,0,2)
| table msgcode
| lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc
| fields helpdoc
| return $helpdoc
] | table *
Hi jkat54,
Thanks for the code, that was very helpful. this works fine for what I am trying to achieve,.
I will need to look in to the details about your using "return $helpdoc" and the fact that you start with inputlookup which is the other way around as I did. Thanks again!!
My final code is now:
|inputlookup [ | makeresults | eval msgtxt="$nr$" , msgcode=substr(msgtxt,5,2) | table msgcode | lookup EVENTLIST_3v3 nr as msgcode OUTPUT helpdoc | fields helpdoc | return $helpdoc ] | table helpbest regards Ashley Pietersen
Glad to help.
The return and format commands are essential when using subsearches.
Use this command reference for more details on those two commands:
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/ListOfSearchCommands