Apply a lookup only to events before a certain time

[Shtark]

I need to apply a lookup only to events before a certain point in time (the data added by the lookup is now included in the events). I haven't seen anything to indicate that this could be done to a whole lookup, only per item in the lookup table (temporal lookup).

My only thought on how it might be possible was if a timestamp was added to each item in the lookup, max_offset_secs was set to 0 and min_offset_secs was negative but I don't know if that would be valid. The documentation for those settings only refers to the event being later than the timestamp in the lookup, not earlier.

Any ideas/answers gladly welcomed.

[woodcock]

The way to do a conditional lookup is to make sure that the input field is null for the events that should not have lookups. This is particularly useful for situations where the lookup is both expensive and guaranteed to fail (e.g. doing a dnslookup for IP addresses that you know are bogus). It works like this:

... | conditionalizedLookupField=if((_time<threshold_time), myLookupField, null() | lookup myLookup conditionalizedLookupField AS myLookupField OUTPUT myOutputField