How to use earliest and latest in my inputlookup search to filter results?

[tsidie]

Hello Splunk Answers!

I'm relatively new to Splunk - pardon if this is a very basic question. I've looked through previous answers without luck.

I'm trying to query Splunk Enterprise Security notable events by using inputlookup es_notable_events, and also trying to slim down results with an earliest and latest filter:

| inputlookup es_notable_events | earliest=-1h latest=now

However, this doesn't do the trick. How can I use inputlookup with earliest and latest?

Thank you for looking and any help you might be able to offer!

[jkat54]

See if this answer helps:

https://answers.splunk.com/answers/100326/time-range-options-in-correlation-search.html

It's a fairly common request amoung splunk ES users

"site:answers.splunk.com splunk enterprise security inputlookup earliest latest" <- on google might help find some more solutions.

[tsidie]

Thanks very kindly, jkat54! To clarify, I'm running this query against the REST API.

It seems that I may have to abandon using earliest and latest in the query, from that link and some of the others I saw. I was hoping this wasn't the case - users directly enter values such as "-1h" in our interface, but we can convert those to seconds.

I'll give it a shot and see if it'll work - I'll hold off on accepting to give others a chance for a little bit. Thanks!