https://community.splunk.com/t5/Getting-Data-In/configure-time-based-lookup-table/m-p/470161#M99656 <P>I have a CSV lookup table with a field that contains latest_event and the value is in format "12/25/2019 12:10" (%m/%d/%Y %H:%M) and the time zone is CST. I am comparing latest_event filed with some other fileds (_time</P> Wed, 30 Sep 2020 02:45:12 GMT nagarjuna560 2020-09-30T02:45:12Z https://community.splunk.com/t5/Getting-Data-In/configure-time-based-lookup-table/m-p/470161#M99656 <P>I have a CSV lookup table with a field that contains latest_event and the value is in format "12/25/2019 12:10" (%m/%d/%Y %H:%M) and the time zone is CST. I am comparing latest_event filed with some other fileds (_time</P> Wed, 30 Sep 2020 02:45:12 GMT https://community.splunk.com/t5/Getting-Data-In/configure-time-based-lookup-table/m-p/470161#M99656 nagarjuna560 2020-09-30T02:45:12Z https://community.splunk.com/t5/Getting-Data-In/configure-time-based-lookup-table/m-p/470162#M99657 <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/Defineatime-basedlookupinSplunkWeb">https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/Defineatime-basedlookupinSplunkWeb</A></P> Fri, 25 Oct 2019 19:57:49 GMT https://community.splunk.com/t5/Getting-Data-In/configure-time-based-lookup-table/m-p/470162#M99657 starcher 2019-10-25T19:57:49Z https://community.splunk.com/t5/Getting-Data-In/configure-time-based-lookup-table/m-p/470163#M99658 <P>I mentioned the name of the filed as "latest_event" and time format as "%m/%d/%Y %H:%M" ( 10/12/2019 10:12)</P> <P>and I ran search | inputlookup lookupname.csv | table latest_event<BR /> I got the results as "10/12/2019 10:12", as per the documentation default time is in UTC, then the result should be like "10/12/2019 05:12"</P> Fri, 25 Oct 2019 20:59:44 GMT https://community.splunk.com/t5/Getting-Data-In/configure-time-based-lookup-table/m-p/470163#M99658 nagarjuna560 2019-10-25T20:59:44Z