https://community.splunk.com/t5/Splunk-Search/How-to-compare-CutoffTime-with-current-time/m-p/590289#M205516 <P>I was able to figure out working query.Yes I have used similar logic mentioned by you.Thanks for the response.</P> Tue, 22 Mar 2022 18:51:51 GMT pradeepkm 2022-03-22T18:51:51Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-CutoffTime-with-current-time/m-p/590050#M205430 <P>&nbsp;I have created a lookup table with filename and cutofftime within which we have to receive the file. I have to compare Cutofftime to check if its falling within 30 mins of current time and retrieve that particular file name from lookup&nbsp; and search for it. Please help me with query</P> Wed, 23 Mar 2022 04:16:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-CutoffTime-with-current-time/m-p/590050#M205430 pradeepkm 2022-03-23T04:16:23Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-CutoffTime-with-current-time/m-p/590285#M205514 <P>Assuming your lookup field for cutofftime has epoch value, you can retrieve the filename based on your condition like this:</P><LI-CODE lang="markup">| inputlookup yourLookupName.csv | table filename cutofftime | where abs(cutofftime-now())&lt;=1800 | table filename</LI-CODE><P>If it's in some specific string timestamp format, replace "abs(cutofftime-now())" with "abs(strptime(cutofftime,"Your Time Format")-now()".&nbsp; Find your <A href="https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Commontimeformatvariables" target="_self">Timeformat here</A>.</P><P>Once you finalize your above query, your search data for your retrieved file like this:</P><LI-CODE lang="markup">index=YourIndex sourcetype=YourSourcetype [| your finalized query | which will give filename. your may have to rename field 'filename' to field name that your index/sourcetype has] </LI-CODE> Tue, 22 Mar 2022 18:05:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-CutoffTime-with-current-time/m-p/590285#M205514 somesoni2 2022-03-22T18:05:34Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-CutoffTime-with-current-time/m-p/590289#M205516 <P>I was able to figure out working query.Yes I have used similar logic mentioned by you.Thanks for the response.</P> Tue, 22 Mar 2022 18:51:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-CutoffTime-with-current-time/m-p/590289#M205516 pradeepkm 2022-03-22T18:51:51Z