https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239343#M71100 <P>This isn't elegant, it's inefficient. You should be able to filter by time before results are ever brought into the search pipeline.</P> Thu, 30 Apr 2020 22:19:35 GMT frechette 2020-04-30T22:19:35Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239338#M71095 <P>I have a large data set in my KV Store collections. These fields also contains time specific fields. I would like to perform filtering on these time based fields by time picker. Any suggestions for implementation. </P> Thu, 05 May 2016 09:41:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239338#M71095 nawneel 2016-05-05T09:41:32Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239339#M71096 <P>Like this:</P> <PRE><CODE>| inputlookup MyKVstoreName | addinfo | where MyTimeField &gt;= info_min_time AND MyTimeField &lt;= info_max_time </CODE></PRE> Thu, 05 May 2016 15:24:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239339#M71096 woodcock 2016-05-05T15:24:13Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239340#M71097 <P>This Works wonders . thanks @woodcock</P> Fri, 06 May 2016 05:45:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239340#M71097 nawneel 2016-05-06T05:45:48Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239341#M71098 <P>Perfect Gregg! Thanks for this. Elegant and effective.</P> Mon, 16 Jan 2017 21:27:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239341#M71098 tnesavich_splun 2017-01-16T21:27:19Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239342#M71099 <P>I am full of IT, ask anybody.</P> Fri, 18 May 2018 01:57:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239342#M71099 woodcock 2018-05-18T01:57:02Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239343#M71100 <P>This isn't elegant, it's inefficient. You should be able to filter by time before results are ever brought into the search pipeline.</P> Thu, 30 Apr 2020 22:19:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239343#M71100 frechette 2020-04-30T22:19:35Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239344#M71101 <P>You can also add the time filter into the <CODE>WHERE</CODE> clause of <CODE>inputlookup</CODE>, e.g.</P> <P><CODE>| inputlookup MyKVstoreName WHERE <BR /> [| makeresults count=1 <BR /> | addinfo <BR /> | eval info_max_time=if(info_max_time=="+Infinity", 2147483647, info_max_time) <BR /> | eval search="( (MyTimeField&gt;=" . info_min_time . ") AND (" . "MyTimeField&lt;" . info_max_time . ") )" <BR /> | table search ]</CODE> </P> Sat, 02 May 2020 14:52:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/239344#M71101 dnitschke_splun 2020-05-02T14:52:14Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/700993#M237820 <P>worked for me. beautiful solution. thanks a lot</P> Fri, 04 Oct 2024 14:06:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-on-KV-Store-lookup-time-based-fields-using-a-time/m-p/700993#M237820 highsplunker 2024-10-04T14:06:23Z