Dashboards & Visualizations

How can I use multiple lookup tables in a dashboard?

JD_Symantec
New Member

Trying to develop a pull-down field in a dashboard to select from multiple lookup tables that include different usernames? for example, the lookups may be labeled USECASE1, USECASE2, USECASE3, USECASE4, etc.

Tags (2)
0 Karma

vasanthmss
Motivator

Hi JD,

if you want to display the user field values from multiple lookup table then the below query will helps you, Assuming all your lookup(USECASE1,etc) contains user field named user.

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 | table user] | append[ | inputlookup USECASE3| table user] | stats count by user | table user

If you have the different field names in other lookup you can rename it, as like the below search

|inputlookup USECASE1 | table user |append[|inputlookup USECASE2 |rename user2 as user | table user] | append[ | inputlookup USECASE3| rename user3 as user | table user] | stats count by user | table user

If you are looking for a list of lookup table available across the application and user this will help you.

|rest /servicesNS/admin/search/data/lookup-table-files | table title

if you want you can retrieve based on required user / app etc..

Hope this will help you.

Cheers!

V
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...