How to edit my inputlookup search to match the _time field from kvstore with the dashboard's time range picker?

[lassel]

I have a heavy and complex search that runs as a scheduled search and saves its results in a lookup table.
The kvstore has a field called _time that is configured for time based lookups.

Now, I want to make a dashboard that searches my inputlookup.
So I add a panel with a search:

| inputlookup mylookup

But to my disappointment, I learned that searches that only hit a lookup doesn't support time pickers directly.

I tried this and a few other suggestions from answers.splunk.com, but I can't find answers that don't hard code the time range

| inputlookup mylookup earliest=$time.earliest$ latest=$time.latest$   

How can I modify my search, so the _time field gets matched to the time picker on my page?

[alacercogitatus · Accepted solution]

First: If you have a requirement for _time based sorting and searching, do NOT use a kvstore. It wasn't designed for that. Instead, use summary indexing techniques which put the events back into searchable buckets with the correct time stamps. Then you can use a time picker to your heart's content over the summarized data. There really isn't anything you can do with the lookup to make it work like you wish.

Here is an oldie, but goodie on summary indexing. http://www.splunk.com/view/SP-CAAACZW

[lassel]

A summary index is a better solution. I must have skipped over it - so many concepts to learn 🙂

I have to add that to preserve extracted fields in my query I had to apply a hack that I found in another answer:

| rename _raw as orig_raw

http://answers.splunk.com/answers/22431/adding-host-field-when-summary-indexing.html