topic Delete old data from lookupfile in Splunk Search

Delete old data from lookupfile

Ravan — Sat, 21 Jan 2012 18:09:45 GMT

Hi,

I have a lookup file which will get update daily(from a scheduled search ), I need keep only last 45 days data in it, means data which is added 45 days back needs to be deleted.(we have _time field in lookup file)

Please let me know if there is any other way to store the data(which will update daily ) with out using lookup file.

Re: Delete old data from lookupfile

dwaddle — Sat, 21 Jan 2012 18:38:16 GMT

This (should be) fairly trivial as part of your scheduled search that creates your lookup. I assume that your lookup is created roughly as follows:

some_search_terms | inputlookup append=true lookup.csv | 
some_other_stuff | outputlookup lookup.csv

Following this paradigm, you can insert something like this before the outputlookup:

| where _time >= now() - (86400 * 45)