topic Re: Lookup with range in Splunk Dev

Lookup with range

TISKAR — Sun, 29 Jul 2018 17:38:20 GMT

Hello Splunk

I will use lookup with earliest and latest like

I configured time based lookup but that not work, So i use:

earliest=relative_time(now(),"$time.earliest$") | where _time>earliest

Do you konow a solution without relative time, because with relative time i have multiple condition in my dasboards ?

Thank you

Re: Lookup with range

adonio — Sun, 29 Jul 2018 20:01:28 GMT

hello there,
can you elaborate on your challenge? what is it exactly that you are trying to solve?

Re: Lookup with range

DalJeanis — Mon, 30 Jul 2018 02:33:01 GMT

Your dashboard can use a time picker to set tokens for a time range, and then you use

| where _time>=$token_for_earliest$ AND _time<$token_for_latest$

You can search around for more details in the docs (like the sample xml dashboards) and in answers like this one ...
https://answers.splunk.com/answers/591175/how-to-manipulate-a-timestamp-token-from-a-timesta.html

Re: Lookup with range

woodcock — Mon, 30 Jul 2018 02:39:36 GMT

If I understand you correctly, like this:

Your Regular Search WITHOUT earliest AND latest here [|inputlook YourLookupContainingBOTHearliestANDlatest | table earliest latest]

Do note that both earliest and latest in the lookup must be time_t integers (AKA epoch). If the format is anything else, you must convert them using strptime.

Re: Lookup with range

DalJeanis — Tue, 31 Jul 2018 17:02:07 GMT

@Tiskar - did you intend to close the question, or to accept one of the answers?

Re: Lookup with range

TISKAR — Tue, 31 Jul 2018 18:19:05 GMT

Thank you

But i alrady have a dashboard with time range picker, and i can't use | eval earliest_DB1 = strftime(@d, "%Y-%m-%d %H:%M:%S")

Re: Lookup with range

TISKAR — Tue, 29 Sep 2020 20:46:03 GMT

So i less my solution with relative time with multiple conditions like:

| eval earliest_DB1 = strptime(relative_time(now(), "@d"),.....)

where _time>earliest

Thnk youi can't accept my solution

Re: Lookup with range

DalJeanis — Tue, 31 Jul 2018 21:36:27 GMT

@TISKAR - I don't understand your comment. If you join the Splunk Slack channel, and go to the #dashboards subchannel, someone may be able to talk you through what you need.