https://community.splunk.com/t5/Splunk-Dev/How-to-do-time-based-lookup-using-python/m-p/99383#M1405 <P>Anyone out there doing time-based lookups with an external python script? How do you handle the time portion of the lookup configuration? Same as you would for a CSV lookup? </P> Sat, 04 Dec 2010 10:04:32 GMT Jeremiah 2010-12-04T10:04:32Z https://community.splunk.com/t5/Splunk-Dev/How-to-do-time-based-lookup-using-python/m-p/99383#M1405 <P>Anyone out there doing time-based lookups with an external python script? How do you handle the time portion of the lookup configuration? Same as you would for a CSV lookup? </P> Sat, 04 Dec 2010 10:04:32 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-do-time-based-lookup-using-python/m-p/99383#M1405 Jeremiah 2010-12-04T10:04:32Z https://community.splunk.com/t5/Splunk-Dev/How-to-do-time-based-lookup-using-python/m-p/99384#M1406 <P>Per Steve Zhang, the Director of Search, there are two ways to do a time-based external lookup. </P> <UL> <LI><P>Have Splunk’s lookup mechanism handle the temporal aspect</P> <UL> <LI><P>In this case, the external lookup returns all relevant matches over all-time, and Splunk will constrain matches based on the time_field, time_format, etc specified in transforms.conf. This is analogous to how time-based CSV-based lookups work in Splunk.</P></LI> <LI><P>The time-based configuration would perform the comparison on the time values and return the relevant results to search based on the lookup configuration.</P></LI> </UL></LI> <LI><P>Let the external script handle the temporal aspect implicitly by adding _time as a field to match on</P> <UL> <LI>In this case, the external script will need to know that the value of _time is not an exact match against the “time” column above, but rather “closest but no later than”</LI> </UL></LI> </UL> <P></P><HR /><P></P> <P>Which approach to implement depends on how often the matching field changes – in other words, over all time, how many different rows are there that contain a given value to be matched upon?</P> <P>If the number of rows/changes is small, then either option above should be fine. It the number is large, then letting the script handle time matching is likely better.</P> <P>In either case, it would be wise to implement caching to reduce calls to the DB.</P> Wed, 08 Dec 2010 05:04:51 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-do-time-based-lookup-using-python/m-p/99384#M1406 araitz 2010-12-08T05:04:51Z