Splunk Search

Is it possible to set a token using a field found in a lookup without drilldown?

jamesmarlowww
Path Finder

Can I set a token using a field found in a lookup table? I've been researching online, but I haven't found a real solution. Thanks in advanced for any help

1 Solution

sundareshr
Legend

Yes you can. The online documentation has a few examples showing use of token for things other than drill-down. There's one on dynamic display of elements. What specifically are you looking for?

http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/tokens

View solution in original post

sundareshr
Legend

Yes you can. The online documentation has a few examples showing use of token for things other than drill-down. There's one on dynamic display of elements. What specifically are you looking for?

http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/tokens

jamesmarlowww
Path Finder

Thanks that's helpful. I was looking to set the outputed ID to the token $ID$

    <title>Lookup customer</title>
    <searchString>index = foo | head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT ID</searchString> 
0 Karma

sundareshr
Legend

Do you not see the value of the token pass in?

jamesmarlowww
Path Finder

Yes I can see the value. But I don't know how to pass a value to a token inside a search.

I've tried to implement your example like this, but it isn't working.

    <searchString>index = foo| head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT  ID ect ect ect | rename ect as "blah"| transpose</searchString>
    <earliestTime>-60m@m</earliestTime>
    <latestTime>now</latestTime>
    <progress>
      <condition match="'job.resultCount' ==*">
        <set token="ID">$row.ID$</set>
      </condition>
      <condition match="'job.resultCount' !=*">
        <set token="ID">$row.ID$</set>
      </condition>
      <change>
         <set token="ID">$row.ID$</set>
      </change>
   </progress>
0 Karma

jamesmarlowww
Path Finder

I've come to the conclusin that this isn't possbile in my version of splunk (6.1). I think it's possible in 6.2 or later. You need to put the progress or change options inside search and query objects like in by sundareshr's answer

0 Karma

nfilippi_splunk
Splunk Employee
Splunk Employee

Just to clarify, there are a few things that will not work in the above xml code:

  • searchString/earliestTime/latestTime is legacy syntax for search
  • is a new event handler introduced in Splunk 6.3
  • event handler is only supported within form inputs
  • is only available for drilldown

So based on the above, here's what it should really look like:

<search>

   <query>index = foo| head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT  ID ect ect ect | rename ect as "blah"| transpose</query>
   <earliest>-60m@m</earliest>
   <latest>now</latest>

   <progress> 
      <set token="ID">$result.ID$</set>
   </progress>

<search>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...