All Apps and Add-ons

How to filter last 24hrs events from inputlookup

gopiven
Explorer

Hello Splunk Experts

As I have scheduled search(running every hr) creating output lookup file and from there I am using that as input lookup in my dashboards to draw trends for last 7 days and 24 hrs.
However for last 7 days I am able to draw the trend but for 24 hrs I dont know how to filter the events from the overall lookup.

Overall the lookup contains 7 days data and I need to draw the trend for last 7 days and 24 hrs trend.

Kindly help me with the concept please.

Thanks

0 Karma
1 Solution

siddharthkhatsu
Explorer

| inputlookup lookupname | addinfo | where time_field < info_max_time and time_field> info_min_time

P.S. it works best if you have your time field in epoch, else you need to do pre processing on your time field like

| inputlookup lookupname | eval time_field= strptime(time_field, time_format) | addinfo | where time_field < info_max_time and time_field> info_min_time

View solution in original post

woodcock
Esteemed Legend

Like this:

|inputlookup YourLookupFileWithTimeDateFieldHere
| where _time >= relative_time(now(), "-24h")

gopiven
Explorer

Thanks Woodcock for the response.

0 Karma

siddharthkhatsu
Explorer

| inputlookup lookupname | addinfo | where time_field < info_max_time and time_field> info_min_time

P.S. it works best if you have your time field in epoch, else you need to do pre processing on your time field like

| inputlookup lookupname | eval time_field= strptime(time_field, time_format) | addinfo | where time_field < info_max_time and time_field> info_min_time

gopiven
Explorer

Thanks Sid - It worked for me.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...