Dashboards & Visualizations
Highlighted

How to pull events from last 24 hours from a lookup table?

Explorer

I'm attempting to pull events that happened in the last 24 hours from a lookup table and create a daily report. No matter what combination I try (using bin, earliest and latest), nothing seems to pull the last 24 hours. Not even the time range picker on the right hand side of the search bar.

Here is an example of the search I'm running:

| inputlookup incident_review_lookup | bin _time span=24h | convert timeformat=%Y/%m/%d-%H:%M:%S ctime(time) AS _time | fields - time

Thanks for the help and guidance.

0 Karma
Highlighted

Re: How to pull events from last 24 hours from a lookup table?

Builder

I believe the following is necessary in order to filter time from a lookup. Set your search time to last 24 hours, then use something like the following:

| inputlookup incident_review_lookup 
| where  time >= [| gentimes start=-1 | addinfo | eval search=info_min_time | table search]
AND
time <= [| gentimes start=-1 | addinfo | eval search=info_max_time | table search]

| eval time=strftime(_time, "%Y-%h-%d %T")
| table time

This will filter based on the global splunk time settings you select from the time selector.

0 Karma
Highlighted

Re: How to pull events from last 24 hours from a lookup table?

Explorer

Much appreciate the help but this did not work. All I get is a table of blank time.

0 Karma
Highlighted

Re: How to pull events from last 24 hours from a lookup table?

Builder

What is the time field called in your lookup table. Is it "time" ? You might need to rename it to time before processing, and change the search above to use "time" instead. I can do some testing in a little bit.

0 Karma