topic Re: Search two fields in one csv lookup in Splunk Search

Search two fields in one csv lookup

ocampocliff1 — Wed, 22 Mar 2017 04:18:25 GMT

I want to use fields two fields that i have inside the lookup,

Inside my lookup i have "account" and "date"

basically i want to do is to search the account with the date which is greater than today.

Re: Search two fields in one csv lookup

adonio — Wed, 22 Mar 2017 18:26:04 GMT

Hello ocampocliff1,
here is the csv i created:

if the date format is different on your end, you will have to change the time format in the eval statements. you can find the formats here: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables

using this search:

| inputlookup accounts.csv 
 | eval new_time = strptime(date, "%m/%d/%Y") 
 | eval c_time=strftime(new_time,"%m/%d/%y %H:%M:%S") 
 | eval now = now() 
 | where new_time > now 
 | table account, c_time

i got this:

you can play with the | where clause as you please to find accounts on a time frame

Hope it helps

Re: Search two fields in one csv lookup

adonio — Wed, 22 Mar 2017 19:40:07 GMT

Re: Search two fields in one csv lookup

adonio — Wed, 22 Mar 2017 19:40:47 GMT

couldn't edit the answer to show screenshots. they are in the answer below

Re: Search two fields in one csv lookup

ocampocliff1 — Thu, 23 Mar 2017 00:54:08 GMT

Hi adonio,

Thanks for this one!

I'm using this concept now. 🙂

Re: Search two fields in one csv lookup

adonio — Thu, 23 Mar 2017 12:40:36 GMT

you are welcome!
if that answers, can you mark as "answered"?
thanks!