https://community.splunk.com/t5/Getting-Data-In/Filtering-results-from-inputlookup-by-date-time/m-p/151567#M30839 <P>I have searched for hours on this and can't seem to find a way to do it. I have a .csv file being read in with inputlookup and the first column is _time... I want to be able to run a query that includes grabbing the file with inputlookup and then filtering the results based on a specific date range. I have tried piping earliest/latest afterwards, using gentimes, making the inputlookup into a subsearch and trying to do the earliest/latest search beforehand... alas, I keep coming up short. The closest I can get is the solution found here: <A href="http://answers.splunk.com/answers/11194/time-based-inputookup?sort=oldest">http://answers.splunk.com/answers/11194/time-based-inputookup?sort=oldest</A></P> <P>But I dont want to have to write the query using unix timestamp defined date rangees (ie. now() -9000) but instead using dates.</P> <P>Any help would be greatly appreciated. Thanks.<BR /> Eric</P> Fri, 14 Feb 2014 17:42:53 GMT EricLloyd79 2014-02-14T17:42:53Z https://community.splunk.com/t5/Getting-Data-In/Filtering-results-from-inputlookup-by-date-time/m-p/151567#M30839 <P>I have searched for hours on this and can't seem to find a way to do it. I have a .csv file being read in with inputlookup and the first column is _time... I want to be able to run a query that includes grabbing the file with inputlookup and then filtering the results based on a specific date range. I have tried piping earliest/latest afterwards, using gentimes, making the inputlookup into a subsearch and trying to do the earliest/latest search beforehand... alas, I keep coming up short. The closest I can get is the solution found here: <A href="http://answers.splunk.com/answers/11194/time-based-inputookup?sort=oldest">http://answers.splunk.com/answers/11194/time-based-inputookup?sort=oldest</A></P> <P>But I dont want to have to write the query using unix timestamp defined date rangees (ie. now() -9000) but instead using dates.</P> <P>Any help would be greatly appreciated. Thanks.<BR /> Eric</P> Fri, 14 Feb 2014 17:42:53 GMT https://community.splunk.com/t5/Getting-Data-In/Filtering-results-from-inputlookup-by-date-time/m-p/151567#M30839 EricLloyd79 2014-02-14T17:42:53Z https://community.splunk.com/t5/Getting-Data-In/Filtering-results-from-inputlookup-by-date-time/m-p/151568#M30840 <P>did you attempt to do a strptime on the field |inputlookup myFile.csv | eval mytime=strptime(_time,formatoftime)</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Commontimeformatvariables">http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Commontimeformatvariables</A></P> <P>This way you can then use "mytime" as regular date/times.</P> Fri, 14 Feb 2014 17:53:37 GMT https://community.splunk.com/t5/Getting-Data-In/Filtering-results-from-inputlookup-by-date-time/m-p/151568#M30840 aelliott 2014-02-14T17:53:37Z https://community.splunk.com/t5/Getting-Data-In/Filtering-results-from-inputlookup-by-date-time/m-p/151569#M30841 <P>I have thought about this and tried it but not the way you presented it. Im pondering how to further filter the results with the new mytime variable.<BR /><BR /> | inputlookup indextest_sourcetype.csv | eval mytime=strptime(_time, "%m/%d/%Y") | where mytime ... or can I add a search here? My preference ultimately would be to be able to use the earliest/latest relational date pickers.. Ill keep experimenting</P> Mon, 28 Sep 2020 15:53:48 GMT https://community.splunk.com/t5/Getting-Data-In/Filtering-results-from-inputlookup-by-date-time/m-p/151569#M30841 EricLloyd79 2020-09-28T15:53:48Z https://community.splunk.com/t5/Getting-Data-In/Filtering-results-from-inputlookup-by-date-time/m-p/151570#M30842 <P>Thanks man, with your hint I was able to figure it out. Its ugly but it works. Any suggestion on how it could be improved would be welcomed.</P> <P>| inputlookup indextest_sourcetype.csv | eval early="2/10/2014" | eval late="2/12/2014" | eval myearlytime=strptime(early, "%m/%d/%Y") | eval mylatetime=strptime(late, "%m/%d/%Y") | where _time &gt;= myearlytime AND _time &lt;= mylatetime</P> Fri, 14 Feb 2014 19:25:27 GMT https://community.splunk.com/t5/Getting-Data-In/Filtering-results-from-inputlookup-by-date-time/m-p/151570#M30842 EricLloyd79 2014-02-14T19:25:27Z