https://community.splunk.com/t5/Splunk-Search/Timestamp-comparison-from-an-inputlookup/m-p/494573#M137863 <P>Try this:</P> <PRE><CODE>| inputlookup lookup_name | fields key_field, timestamp_A | append [search index=index_name | stats max(timestamp_B) as timestamp_A by key_field] | stats max(timestamp_A) as timestamp_A by key_field </CODE></PRE> Wed, 11 Mar 2020 16:59:00 GMT manjunathmeti 2020-03-11T16:59:00Z https://community.splunk.com/t5/Splunk-Search/Timestamp-comparison-from-an-inputlookup/m-p/494572#M137862 <P>Hi All,<BR /> I do have cumbersome problem...I have a table built out from an inputlookup search. We have n-columns in this table but a key ones are the key_field and a timestamp_A.<BR /> We would like to run a subsearch within the inputlookup where, for each value in key_field, we check the most recent value of a timestamp_B in another index. If this value is more recent than the one in timestamp_A we update the timestamp value with the B value, otherwise we leave the timestamp_A.<BR /> Assuming that both timestamps are in the same format we have the following restrictions: the value in timestamp_A might be empty, in this case if exist a timestamp_B value OK otherwise we leave empty. </P> <P>Very much appreciated any help that could be provided.</P> Wed, 30 Sep 2020 04:36:53 GMT https://community.splunk.com/t5/Splunk-Search/Timestamp-comparison-from-an-inputlookup/m-p/494572#M137862 DomenicoFumarol 2020-09-30T04:36:53Z https://community.splunk.com/t5/Splunk-Search/Timestamp-comparison-from-an-inputlookup/m-p/494573#M137863 <P>Try this:</P> <PRE><CODE>| inputlookup lookup_name | fields key_field, timestamp_A | append [search index=index_name | stats max(timestamp_B) as timestamp_A by key_field] | stats max(timestamp_A) as timestamp_A by key_field </CODE></PRE> Wed, 11 Mar 2020 16:59:00 GMT https://community.splunk.com/t5/Splunk-Search/Timestamp-comparison-from-an-inputlookup/m-p/494573#M137863 manjunathmeti 2020-03-11T16:59:00Z