Interactively open text/csv file based on the selection from the dropdown list

[wiggler]

Hi everyone, I would like to ask on how to achieve this or if it is possible to implement. I have a dashboard with a simple drop down that shows the student name where I can select. If I select a student name from the drop down list, I want to display the contents on a text/csv file which store in the local disk. the filename of the file is the same as the student_name it contains some information about the student.

the filename format is something like below:
student_name1.csv
student_name2.csv
student_name3.csv
and so on..

<form>
  <label>Student Record</label>
  <fieldset submitButton="false">

    <input type="dropdown" token="student_name">
      <label>Student Name</label>
      <default>*</default>
      <search>
        <query> "SELECT student_name FROM student_records" shortnames=true | table student_name | sort student_name </query>
      </search>
    </input>

  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>  $student_name$  </query>
        </search>
      </table>
    </panel>
  </row>
</form>  

How do I achieve this that when I select a student name from the drop down, it will open a text/csv file from the local disk?

Thanks.

[niketn · Accepted solution]

@wiggler, have you tried the following? Token $student_name$ from the dropdown to be passed on to the filename for inputlookup:

   <row>
     <panel>
       <table>
         <search>
           <query>| inputlookup $student_name$.csv</query>
         </search>
       </table>
     </panel>
   </row>

[wiggler]

@niketnilay, your solution works and I was able to view the csv file. Question is, what if the CSV is located under a subfolder?

[niketn]

@wiggler, I dont know what you imply by lookup under sub-folder. Ideally when lookup is defined it can be directly accessed by its name. Are you indexing csv file or have you uploaded them as lookup? Or is the question about lookup in separate Splunk apps with access permissions not Global?

[wiggler]

Hi @niketnilay, sorry for the confusion. What I mean is that under the default lookup directory, I created a directory with CSV files on it. but when I tried, the inputlook doesn't work on sub-directories. So I would like to know if there's an option or setting that I need to enable to make it work. I am not sure about the access permission and global but my app is only using the default lookup path. thanks a lot

[niketn]

Try adding the lookup files through Splunk Web menu Settings > Lookup > Lookup table files
by default they should be stored in the following Splunk path

`$SPLUNK_HOME/etc/apps/<YourAppName>/lookups`

So if you plan to place the files manually, you should place the same here.

[wiggler]

@niketnilay, so it's not really possible to have a sub-folder under the default lookup just like below:

`$SPLUNK_HOME/etc/apps/<YourAppName>/lookups/mysubfolderhere`

then in that mysubfolderhere contains csv's that I manually upload from time to time.

[niketn]

Not as far as I know!

[sbbadri]

try this

<query> | inputlookup student_name*.csv | table student_name | sort student_name </query>

[wiggler]

@sbbadri, thank for you suggestion.