Splunk Enterprise Security

How to use earliest and latest in my inputlookup search to filter results?

tsidie
Engager

Hello Splunk Answers!

I'm relatively new to Splunk - pardon if this is a very basic question. I've looked through previous answers without luck.

I'm trying to query Splunk Enterprise Security notable events by using inputlookup es_notable_events, and also trying to slim down results with an earliest and latest filter:

| inputlookup es_notable_events | earliest=-1h latest=now

However, this doesn't do the trick. How can I use inputlookup with earliest and latest?

Thank you for looking and any help you might be able to offer!

0 Karma

jkat54
SplunkTrust
SplunkTrust

See if this answer helps:

https://answers.splunk.com/answers/100326/time-range-options-in-correlation-search.html

It's a fairly common request amoung splunk ES users

"site:answers.splunk.com splunk enterprise security inputlookup earliest latest" <- on google might help find some more solutions.

tsidie
Engager

Thanks very kindly, jkat54! To clarify, I'm running this query against the REST API.

It seems that I may have to abandon using earliest and latest in the query, from that link and some of the others I saw. I was hoping this wasn't the case - users directly enter values such as "-1h" in our interface, but we can convert those to seconds.

I'll give it a shot and see if it'll work - I'll hold off on accepting to give others a chance for a little bit. Thanks!

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...