https://community.splunk.com/t5/Splunk-Search/How-to-incorporate-metadata-command-in-my-lookup-table-to-be/m-p/213704#M62694 <P>I have a few searches I have added a lookup table to. All of them work, but one. The one below uses <CODE>metadata</CODE> and I'm not sure how to make it work with the lookup table. My goal it to find host that have not connected in the last 5 min.</P> <PRE><CODE>| metadata [| inputlookup Meeting_Rooms | fields host] | eval age = now()-lastTime | where age &gt; 50 | convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") |rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Time" | sort + "lastTime" | table host "Time Offline" "Last Time" </CODE></PRE> <P>This is not getting any results. If I replace <CODE>[| inputlookup Meeting_Rooms | fields host]</CODE> with <CODE>type=hosts</CODE> it works fine, but will show all host. Any ideas how I can make this work with my lookup table?</P> Mon, 26 Sep 2016 18:32:53 GMT chadman 2016-09-26T18:32:53Z https://community.splunk.com/t5/Splunk-Search/How-to-incorporate-metadata-command-in-my-lookup-table-to-be/m-p/213704#M62694 <P>I have a few searches I have added a lookup table to. All of them work, but one. The one below uses <CODE>metadata</CODE> and I'm not sure how to make it work with the lookup table. My goal it to find host that have not connected in the last 5 min.</P> <PRE><CODE>| metadata [| inputlookup Meeting_Rooms | fields host] | eval age = now()-lastTime | where age &gt; 50 | convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") |rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Time" | sort + "lastTime" | table host "Time Offline" "Last Time" </CODE></PRE> <P>This is not getting any results. If I replace <CODE>[| inputlookup Meeting_Rooms | fields host]</CODE> with <CODE>type=hosts</CODE> it works fine, but will show all host. Any ideas how I can make this work with my lookup table?</P> Mon, 26 Sep 2016 18:32:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-incorporate-metadata-command-in-my-lookup-table-to-be/m-p/213704#M62694 chadman 2016-09-26T18:32:53Z https://community.splunk.com/t5/Splunk-Search/How-to-incorporate-metadata-command-in-my-lookup-table-to-be/m-p/213705#M62695 <P>I think I have it working with this.</P> <PRE><CODE>| inputlookup Meeting_Rooms | join type=left host [metadata type=hosts] | eval age = now()-lastTime | where age &gt; 50 | convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") |rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Time" | sort + "lastTime" | table host "Time Offline" "Last Time" </CODE></PRE> Mon, 26 Sep 2016 18:57:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-incorporate-metadata-command-in-my-lookup-table-to-be/m-p/213705#M62695 chadman 2016-09-26T18:57:17Z