topic Re: inputlook in Splunk Search

inputlook

kishan2356 — Mon, 20 Sep 2021 03:16:45 GMT

I have a inputlookup search where I am looking to do a current count vs four week average count. My search is set up so it uses : | inputlookup count.csv | bin _time span=5m

I need my search to display data from prior four weeks like below.

_time	c	Last Week	Two Weeks	Three Weeks Ago	Four weeks Ago
9/19/2021 15:10	265	(Count from 9/12/2021 15:10)	(Count from 9/05/2021 15:10)
9/19/2021 15:15	362	(Count from 9/12/2021 15:15)	(Count from 9/05/2021 15:15)
9/19/2021 15:20	589	(Count from 9/12/2021 15:20)	(Count from 9/05/2021 15:20)
9/19/2021 15:25	700	(Count from 9/12/2021 15:25)	(Count from 9/05/2021 15:25)

The problem is that I would normally use earliest and latest ( but these commands do not work with inputlooks. If anyone has solutions that work for inputlook it would be great!

Re: inputlook

bowesmana — Mon, 20 Sep 2021 04:04:50 GMT

You can add the search window time to the event using addinfo and then filter the events on the _time value in your lookup, e.g.

| addinfo | where _time>=info_min_time AND _time<=info_max_time

so, if your search window is last 4 weeks, then this will return the events from the last 4 weeks only from the lookup.

Is that what you wanted?

If this is part of a dashboard search, then you could use the tokens from your time selector, e.g.

| inputlookup count.csv where _time>=$timerange.earliest$ AND _time<=$timerange.latest$

Re: inputlook

PickleRick — Mon, 20 Sep 2021 05:04:43 GMT

I don't quite understand - what exactly does your lookup contain? Can you provide us with a sample? We already have desired output but we don't know the input.

Re: inputlook

kishan2356 — Mon, 20 Sep 2021 13:22:25 GMT

| where _time>=info_min_time AND _time<=info_max_time

to only display data from last 7 days (one week) if inputlook does not accept earliest and latest?

Re: inputlook

kishan2356 — Mon, 20 Sep 2021 13:32:15 GMT

The lookup only contains counts as seen in the table I have in the original post. My problem is I can't use earliest and latest commands to view historical data week by week.

Re: inputlook

PickleRick — Mon, 20 Sep 2021 14:43:49 GMT

I still don't understand what are the raw contents of the lookup. Anyway, doesn't ( | inputlookup | where _time<=something AND _time>=something) work?

Re: inputlook

bowesmana — Mon, 20 Sep 2021 22:03:27 GMT

Your original post implied the lookup contained _time as a field. If you do not have a time field in your lookup then you can't filter by time. If you have a field called _time in your lookup, then do as I suggest in my previous post. There is a 3rd option which will make a fixed 7 day test (again assuming you have a time field in your lookup)

| inputlookup count.csv | where _time>=relative_time(now(), "-7d@d") AND _time<=now()