Is it possible to set a token using a field found in a lookup without drilldown?

[jamesmarlowww]

Can I set a token using a field found in a lookup table? I've been researching online, but I haven't found a real solution. Thanks in advanced for any help

[sundareshr · Accepted solution]

Yes you can. The online documentation has a few examples showing use of token for things other than drill-down. There's one on dynamic display of elements. What specifically are you looking for?

http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/tokens

[jamesmarlowww]

Thanks that's helpful. I was looking to set the outputed ID to the token $ID$

    <title>Lookup customer</title>
    <searchString>index = foo | head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT ID</searchString> 

[sundareshr]

Do you not see the value of the token pass in?

[jamesmarlowww]

Yes I can see the value. But I don't know how to pass a value to a token inside a search.

I've tried to implement your example like this, but it isn't working.

    <searchString>index = foo| head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT  ID ect ect ect | rename ect as "blah"| transpose</searchString>
    <earliestTime>-60m@m</earliestTime>
    <latestTime>now</latestTime>
    <progress>
      <condition match="'job.resultCount' ==*">
        <set token="ID">$row.ID$</set>
      </condition>
      <condition match="'job.resultCount' !=*">
        <set token="ID">$row.ID$</set>
      </condition>
      <change>
         <set token="ID">$row.ID$</set>
      </change>
   </progress>

[jamesmarlowww]

I've come to the conclusin that this isn't possbile in my version of splunk (6.1). I think it's possible in 6.2 or later. You need to put the progress or change options inside search and query objects like in by sundareshr's answer

[nfilippi_splunk]

Just to clarify, there are a few things that will not work in the above xml code:

• searchString/earliestTime/latestTime is legacy syntax for search
• is a new event handler introduced in Splunk 6.3
• event handler is only supported within form inputs
• is only available for drilldown

So based on the above, here's what it should really look like:

<search>

   <query>index = foo| head 1 | eval $search_type$="$search_value$"  | fields - _* |lookup probe.csv $search_type$ OUTPUT  ID ect ect ect | rename ect as "blah"| transpose</query>
   <earliest>-60m@m</earliest>
   <latest>now</latest>

   <progress> 
      <set token="ID">$result.ID$</set>
   </progress>

<search>