topic Re: How to use timepicker from a CSV lookup? in Splunk Search

How to use timepicker from a CSV lookup?

splunkrocks2014 — Wed, 14 Feb 2018 22:23:29 GMT

I found the similar post here, but the solution doesn't seem to be working. I have a CSV file with a timestamp field that looks as follows:

my_time      name      count
----------   -----     -----
2017-10-13   abc       10
2017-11-13   xyz       20

My search looks this:

| inputlookup mytable.csv | eval _time=strptime(my_time,"%Y-%m-%d")

No matter how I change the time range from the search window, it doesn't change the result. Any clues?

Re: How to use timepicker from a CSV lookup?

micahkemp — Wed, 14 Feb 2018 22:28:06 GMT

Check out the bottom answer on this recent answers post to see if it explains why what you're trying isn't working.

Adding the pertinent text of the answer in question to make it easier to find:

Lookups, even time-based lookups, don't (by default) enable searching by using the timepicker.

However, if you have a time in your lookup file, you can somewhat fake what you may be looking for with a search like:

| inputlookup server_purposes
| eval _time=strptime(start_time, "%Y-%m-%d")
| addinfo
| where _time>=info_min_time and _time<info_max_time

The addinfo command adds your earliest/latest times as chosen by the timepicker and puts them in the fields info_min_time and info_max_time, after which you can use the where command to search for _time values within that range.

Re: How to use timepicker from a CSV lookup?

splunkrocks2014 — Thu, 15 Feb 2018 15:21:11 GMT

That's a time-based lookup, but this is not what I am looking for.

Re: How to use timepicker from a CSV lookup?

micahkemp — Thu, 15 Feb 2018 15:33:48 GMT

That's what the subject referenced, but I don't think that's actually what the poster wanted, and my answer addressed what I think your need is.

I've added that answer to my original answer here as well.

Re: How to use timepicker from a CSV lookup?

splunkrocks2014 — Thu, 15 Feb 2018 16:26:14 GMT

Sorry, it works as what I expected. Thanks.

Re: How to use timepicker from a CSV lookup?

grittonc — Tue, 23 Oct 2018 17:16:36 GMT

Very helpful. Explained in more detail here: https://www.splunk.com/blog/2016/09/16/i-cant-make-my-time-range-picker-pick.html

Re: How to use timepicker from a CSV lookup?

splunkuseradmin — Wed, 30 Sep 2020 00:58:34 GMT

I have same problem but can't get the solution I need..
I have indexed data with fields conferenceID "start Time" "End Time" I basically wants to get output by taking "Start Time" when ever I search using time-picker.
problem: it is always taking _time and giving wrong results but after below query it gives 0 results.
index=test sourcetype=webex "testinc" | eval _time=strptime("Start Time","%Y-%m-%d")
| sort - _time
| addinfo
| where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity")
|table ConferenceID "Start Time" "End Time"