Dashboards & Visualizations

How can I use multiple lookup tables in a dashboard?

JD_Symantec
New Member

Trying to develop a pull-down field in a dashboard to select from multiple lookup tables that include different usernames? for example, the lookups may be labeled USECASE1, USECASE2, USECASE3, USECASE4, etc.

Tags (2)
0 Karma

vasanthmss
Motivator

Hi JD,

if you want to display the user field values from multiple lookup table then the below query will helps you, Assuming all your lookup(USECASE1,etc) contains user field named user.

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 | table user] | append[ | inputlookup USECASE3| table user] | stats count by user | table user

If you have the different field names in other lookup you can rename it, as like the below search

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 |rename user2 as user | table user] | append[ | inputlookup USECASE3| rename user3 as user | table user] | stats count by user | table user

If you are looking for a list of lookup table available across the application and user this will help you.

|rest /servicesNS/admin/search/data/lookup-table-files | table title

if you want you can retrieve based on required user / app etc..

Hope this will help you.

Cheers!

V
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...