topic Re: Lookup Table Modifying _time and timepicker ignoring in Splunk Search

Lookup Table Modifying _time and timepicker ignoring

chrisboy68 — Fri, 24 Jan 2025 14:30:12 GMT

Hi,

Struggling trying to figure out what I'm doing wrong. I have the following SPL

| inputlookup append=t kvstore | eval _time = strptime(start_date, "%Y-%m-%d") | eval readable_time = strftime(_time, "%Y-%m-%d %H:%M:%S")

start_date is YYYY-MM-DD, when I modify the _time, I can see it is changed via readable_time, but the timepicker still ignores the change. I can say search last 30 days and I get the events with _time before the range in the timepicker. Any ideas?

Thanks!

Re: Lookup Table Modifying _time and timepicker ignoring

gcusello — Fri, 24 Jan 2025 14:37:09 GMT

Hi @chrisboy68 ,

timekeeper works with events not with lookups.

if you need to use time with a lookup, use a lookup with "Configure time-based lookup" in Lookup Definition, or better, save the values in a index.

Ciao.

Giuseppe

Re: Lookup Table Modifying _time and timepicker ignoring

chrisboy68 — Fri, 24 Jan 2025 14:51:24 GMT

Ah ok. I changed the definitiion to below. Its still not working, time picker is ignoring the time. Anything else I should do?

Re: Lookup Table Modifying _time and timepicker ignoring

PickleRick — Fri, 24 Jan 2025 15:20:12 GMT

Your timepicker will not work.

Timepicker is responsible for setting the earliest/latest parameters for the search. Those parameters only affect fetching events from indexes at the beginning of the search pipeline when the events are generated with search or tstats (maybe there's another command which they affect but I cannot think of any right now). They don't "filter" the events anywhere after that. Most importantly, if you're doing inputlookup or rest timepicker will not affect your search results in any way. And you can't do anything about it (maybe except some very very ugly bending over backwards with addinfo and filtering with where but that's not something any sane person would do.

Re: Lookup Table Modifying _time and timepicker ignoring

chrisboy68 — Fri, 24 Jan 2025 15:32:12 GMT

My use case requires strict relationships.

This works for my use case, bit clunkly. Thank all.

Re: Lookup Table Modifying _time and timepicker ignoring

PickleRick — Fri, 24 Jan 2025 15:38:34 GMT

OK, whether that's ugly or not is a matter of personal taste of course but be aware that it's a very unintuitive way to handle data and someone tasked with maintenance of this later might have hard time understanding this.