https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-value-in-a-lookup-in-order-to/m-p/280043#M84540 <P>Try like this</P> <PRE><CODE>your base search [| inputlookup my_lookup.csv | eval earliest="@mon-".adjust."mon" | eval latest="@mon+1mon-".adjust."mon" | table earliest latest ] | rest of the search </CODE></PRE> <P>OR </P> <PRE><CODE>your base search [| inputlookup my_lookup.csv | eval earliest="@mon-".adjust."mon" | eval latest="@mon+1mon-".adjust."mon" | table earliest latest | format "" "" "" "" "" ""] | rest of the search </CODE></PRE> Wed, 14 Dec 2016 17:16:06 GMT somesoni2 2016-12-14T17:16:06Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-value-in-a-lookup-in-order-to/m-p/280042#M84539 <P>I have a scheduled report, which is generating a lookup table. In this lookup csv, there is a field called "adjust", which will only ever have a value of 0 or 1.</P> <P>I'm building a second scheduled report, and I'd like the time range of this scheduled report to be dynamic, based on the value of the "adjust" field from the lookup csv above.</P> <P>Rough example: <CODE>earliest=@mon-"adjust"mon latest=@mon+1mon-"adjust"mon</CODE></P> <P>Therefore if "adjust"=0 the range will be this month, and if "adjust"=1 the range will be last month.</P> <P>Any ideas?</P> <P>When I try:</P> <PRE><CODE>earliest=@mon-[|inputlookup my_lookup.csv | return adjust]mon latest=@mon+1mon-[|inputlookup my_lookup.csv | return adjust]mon </CODE></PRE> <P>I get the error:</P> <PRE><CODE>Invalid value "@mon-" for time term 'earliest' </CODE></PRE> <P>Thanks for any help!</P> Wed, 14 Dec 2016 16:50:51 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-value-in-a-lookup-in-order-to/m-p/280042#M84539 adamsmith47 2016-12-14T16:50:51Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-value-in-a-lookup-in-order-to/m-p/280043#M84540 <P>Try like this</P> <PRE><CODE>your base search [| inputlookup my_lookup.csv | eval earliest="@mon-".adjust."mon" | eval latest="@mon+1mon-".adjust."mon" | table earliest latest ] | rest of the search </CODE></PRE> <P>OR </P> <PRE><CODE>your base search [| inputlookup my_lookup.csv | eval earliest="@mon-".adjust."mon" | eval latest="@mon+1mon-".adjust."mon" | table earliest latest | format "" "" "" "" "" ""] | rest of the search </CODE></PRE> Wed, 14 Dec 2016 17:16:06 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-value-in-a-lookup-in-order-to/m-p/280043#M84540 somesoni2 2016-12-14T17:16:06Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-value-in-a-lookup-in-order-to/m-p/280044#M84541 <P>Your second suggestion works beautifully. We wouldn't have come up with that on our own. Thank you!</P> Wed, 14 Dec 2016 18:22:26 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-value-in-a-lookup-in-order-to/m-p/280044#M84541 adamsmith47 2016-12-14T18:22:26Z