Hi,
When I add a link to a search in my dashboard, it works only if I don't finish my search with an outputlookup.
When I put the outputlookup I get a "Server error" but just after that, if I submit the search manually, the search works perfectly. It's only when the search come from my dashboard.
And when I remove the outputlookup from the link in my dashboard, it works too.
I don't undeerstand why Splunk don't "allow" a link to a search with an outputlookup.
Thank you for your help.
It is not the outputlookup
, it is the
part. To prove it, try this:
$VAR1$_$VAR2$
| inputlookup lookup_template.csv
| eval foo="$VAR1$_$VAR2$"
| head 1
| outputlookup DEBUG.csv
I already tried before, the outputlookup doesn't work with any csv filename.
You need to URL Encode
the URL; are you doing that?
https://www.urlencoder.org/
I don't understand, I'm using the "link to a search" function in the drilldown menu. Why do I need to encode an URL? Which URL?
Got it. Never mind.
HI @JuGuSm,
could you share your search?
Ciao.Giuseppe
The search is very simple, I just want to copy a lookup template :
| inputlookup lookup_template.csv | outputlookup $VAR1$_$VAR2$.csv