Lookup with range

[TISKAR]

Hello Splunk

I will use lookup with earliest and latest like

I configured time based lookup but that not work, So i use:

earliest=relative_time(now(),"$time.earliest$") | where _time>earliest

Do you konow a solution without relative time, because with relative time i have multiple condition in my dasboards ?

Thank you

[DalJeanis]

@Tiskar - did you intend to close the question, or to accept one of the answers?

[woodcock]

If I understand you correctly, like this:

Your Regular Search WITHOUT earliest AND latest here [|inputlook YourLookupContainingBOTHearliestANDlatest | table earliest latest]

Do note that both earliest and latest in the lookup must be time_t integers (AKA epoch). If the format is anything else, you must convert them using strptime.

[DalJeanis]

Your dashboard can use a time picker to set tokens for a time range, and then you use

| where _time>=$token_for_earliest$ AND _time<$token_for_latest$

You can search around for more details in the docs (like the sample xml dashboards) and in answers like this one ...
https://answers.splunk.com/answers/591175/how-to-manipulate-a-timestamp-token-from-a-timesta.html

[TISKAR]

Thank you

But i alrady have a dashboard with time range picker, and i can't use | eval earliest_DB1 = strftime(@d, "%Y-%m-%d %H:%M:%S")

[TISKAR]

So i less my solution with relative time with multiple conditions like:

| eval earliest_DB1 = strptime(relative_time(now(), "@d"),.....)

where _time>earliest

Thnk youi can't accept my solution

[DalJeanis]

@TISKAR - I don't understand your comment. If you join the Splunk Slack channel, and go to the #dashboards subchannel, someone may be able to talk you through what you need.

[adonio]

hello there,
can you elaborate on your challenge? what is it exactly that you are trying to solve?