https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-inputlookup-search-to-match-the-time-field-from/m-p/169022#M10390 <P>First: If you have a requirement for _time based sorting and searching, do NOT use a kvstore. It wasn't designed for that. Instead, use summary indexing techniques which put the events back into searchable buckets with the correct time stamps. Then you can use a time picker to your heart's content over the summarized data. There really isn't anything you can do with the lookup to make it work like you wish.</P> <P>Here is an oldie, but goodie on summary indexing. <A href="http://www.splunk.com/view/SP-CAAACZW">http://www.splunk.com/view/SP-CAAACZW</A></P> Mon, 22 Jun 2015 12:21:08 GMT alacercogitatus 2015-06-22T12:21:08Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-inputlookup-search-to-match-the-time-field-from/m-p/169021#M10389 <P>I have a heavy and complex search that runs as a scheduled search and saves its results in a lookup table.<BR /> The kvstore has a field called <CODE>_time</CODE> that is configured for time based lookups.</P> <P>Now, I want to make a dashboard that searches my inputlookup.<BR /> So I add a panel with a search:</P> <PRE><CODE>| inputlookup mylookup </CODE></PRE> <P>But to my disappointment, I learned that searches that only hit a lookup doesn't support time pickers directly.</P> <P>I tried this and a few other suggestions from answers.splunk.com, but I can't find answers that don't hard code the time range</P> <PRE><CODE>| inputlookup mylookup earliest=$time.earliest$ latest=$time.latest$ </CODE></PRE> <P>How can I modify my search, so the <CODE>_time</CODE> field gets matched to the time picker on my page?</P> Mon, 22 Jun 2015 11:57:28 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-inputlookup-search-to-match-the-time-field-from/m-p/169021#M10389 lassel 2015-06-22T11:57:28Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-inputlookup-search-to-match-the-time-field-from/m-p/169022#M10390 <P>First: If you have a requirement for _time based sorting and searching, do NOT use a kvstore. It wasn't designed for that. Instead, use summary indexing techniques which put the events back into searchable buckets with the correct time stamps. Then you can use a time picker to your heart's content over the summarized data. There really isn't anything you can do with the lookup to make it work like you wish.</P> <P>Here is an oldie, but goodie on summary indexing. <A href="http://www.splunk.com/view/SP-CAAACZW">http://www.splunk.com/view/SP-CAAACZW</A></P> Mon, 22 Jun 2015 12:21:08 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-inputlookup-search-to-match-the-time-field-from/m-p/169022#M10390 alacercogitatus 2015-06-22T12:21:08Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-inputlookup-search-to-match-the-time-field-from/m-p/169023#M10391 <P>A summary index is a better solution. I must have skipped over it - so many concepts to learn <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>I have to add that to preserve extracted fields in my query I had to apply a hack that I found in another answer:</P> <PRE><CODE>| rename _raw as orig_raw </CODE></PRE> <P><A href="http://answers.splunk.com/answers/22431/adding-host-field-when-summary-indexing.html">http://answers.splunk.com/answers/22431/adding-host-field-when-summary-indexing.html</A></P> Thu, 25 Jun 2015 11:43:10 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-inputlookup-search-to-match-the-time-field-from/m-p/169023#M10391 lassel 2015-06-25T11:43:10Z