topic Re: Advanced filtering on |inputlookup command in Splunk Search

Advanced filtering on |inputlookup command

ololdach — Wed, 30 Sep 2020 02:28:41 GMT

A large kv lookup table (>2M entries and growing) holds metadata and is processed on a regular schedule to solve some complex correlations. The task at hand is to make accessing the last 5k entries more efficient.

The current search looks like this: |inputlookup kvbig | addinfo | where time>info_min_time | ... Runtime about 80s

has worked like a charm returning the wanted 5k results in a splitsecond.

Question: How can I inject a calculated field/result/parameter into the inputlookup where clause that does NOT come from a UI token? (since it's a scheduled search, no such luck as to have tokens around)

Re: Advanced filtering on |inputlookup command

ololdach — Fri, 04 Oct 2019 09:35:06 GMT

Unfortunately the where clause in inputlookup doesn't support the full eval syntax. Otherwise we could have used something like "...where (time>now()-3600)"

Re: Advanced filtering on |inputlookup command

richgalloway — Fri, 04 Oct 2019 13:04:18 GMT

Try turning the query around.

| inputlookup kvbig append=true where (time>[|makeresults | addinfo | eval testme=round(info_min_time-3600,0) | return $testme]) |...

Re: Advanced filtering on |inputlookup command

ololdach — Fri, 04 Oct 2019 13:50:32 GMT

This is extremely cool. I never thought about inserting a subsearch to substitute a literal value! If I had more than 20 points, I'd reward you plenty. Thanks!