Limit timechart from lookup table

humanBeing — Fri, 15 Oct 2021 13:46:32 GMT

Hello all,

I'm using a lookup table with a _time field to create a timechart which works great.

However, the lookup table has data for say 90 days and I don't always want the timechart to be for the full 90 days.

How can I limit my timechart to 30 days from my lookup table that has 90 days worth of data without deleting the extra 60 days?

The _time field is in already in the format %y-%m-%d %H:%M

I've tried
|inputlookup mylookupfile where earliest=-30d

Thank you!

Re: Limit timechart from lookup table

richgalloway — Fri, 15 Oct 2021 14:54:54 GMT

The queries allowed in the where clause of inputlookup are different from those allowed in the search command. In particular, "earliest" in search maps to the _time field whereas in inputlookup it refers to the "earliest" field.

A further complication is inputlookup where does not recognize time modifiers.

One workaround is to read the entire lookup, convert _time to epoch form, then compare the converted time to the timestamp 30 days old.

| inputlokoup mylookup | eval eTime=strptime(_time, "%Y-%m-%d %H:%%M") | where eTime > relative_time(now(), "-30d") | fields - eTime

topic Limit timechart from lookup table in Splunk Search

Limit timechart from lookup table

Re: Limit timechart from lookup table