https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-entry-from-a-lookup-table/m-p/429576#M122867 <P>The easiest way is to create a time-based lookup definition against your existing lookup file:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Defineatime-basedlookupinSplunkWeb">https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Defineatime-basedlookupinSplunkWeb</A></P> Thu, 20 Jun 2019 23:00:59 GMT woodcock 2019-06-20T23:00:59Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-entry-from-a-lookup-table/m-p/429575#M122866 <P>I'm creating a chart which includes the use of a lookup table file, but I only want it to pull up the latest entry for a field. How would I do this? So far I just have this:</P> <P>| lookup Packaging_User_Targets.csv Username as username OUTPUT Daily_Individual_Goal as Target<BR /> | fields username Completed Target</P> <P>Right now this is pulling up all the 'Target' results for that user, including previous days, but I only want it to include the results from that day. Sorry if this is a repeat, I'm new and having a hard time trying to use answers from different situations. </P> Wed, 30 Sep 2020 00:58:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-entry-from-a-lookup-table/m-p/429575#M122866 mcram52 2020-09-30T00:58:29Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-entry-from-a-lookup-table/m-p/429576#M122867 <P>The easiest way is to create a time-based lookup definition against your existing lookup file:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Defineatime-basedlookupinSplunkWeb">https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Defineatime-basedlookupinSplunkWeb</A></P> Thu, 20 Jun 2019 23:00:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-latest-entry-from-a-lookup-table/m-p/429576#M122867 woodcock 2019-06-20T23:00:59Z