Dashboards & Visualizations

How can I use multiple lookup tables in a dashboard?

JD_Symantec
New Member

Trying to develop a pull-down field in a dashboard to select from multiple lookup tables that include different usernames? for example, the lookups may be labeled USECASE1, USECASE2, USECASE3, USECASE4, etc.

Tags (2)
0 Karma

vasanthmss
Motivator

Hi JD,

if you want to display the user field values from multiple lookup table then the below query will helps you, Assuming all your lookup(USECASE1,etc) contains user field named user.

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 | table user] | append[ | inputlookup USECASE3| table user] | stats count by user | table user

If you have the different field names in other lookup you can rename it, as like the below search

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 |rename user2 as user | table user] | append[ | inputlookup USECASE3| rename user3 as user | table user] | stats count by user | table user

If you are looking for a list of lookup table available across the application and user this will help you.

|rest /servicesNS/admin/search/data/lookup-table-files | table title

if you want you can retrieve based on required user / app etc..

Hope this will help you.

Cheers!

V
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...