Dashboards & Visualizations

How to pull events from last 24 hours from a lookup table?

wtaylor149
Explorer

I'm attempting to pull events that happened in the last 24 hours from a lookup table and create a daily report. No matter what combination I try (using bin, earliest and latest), nothing seems to pull the last 24 hours. Not even the time range picker on the right hand side of the search bar.

Here is an example of the search I'm running:

| inputlookup incident_review_lookup | bin _time span=24h | convert timeformat=%Y/%m/%d-%H:%M:%S ctime(time) AS _time | fields - time

Thanks for the help and guidance.

0 Karma

hortonew
Builder

I believe the following is necessary in order to filter time from a lookup. Set your search time to last 24 hours, then use something like the following:

| inputlookup incident_review_lookup 
| where  time >= [| gentimes start=-1 | addinfo | eval search=info_min_time | table search]
AND
time <= [| gentimes start=-1 | addinfo | eval search=info_max_time | table search]

| eval time=strftime(_time, "%Y-%h-%d %T")
| table time

This will filter based on the global splunk time settings you select from the time selector.

0 Karma

wtaylor149
Explorer

Much appreciate the help but this did not work. All I get is a table of blank time.

0 Karma

hortonew
Builder

What is the time field called in your lookup table. Is it "time" ? You might need to rename it to _time before processing, and change the search above to use "_time" instead. I can do some testing in a little bit.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...