Add "Price" field with different values for specific timeranges

[HeinzWaescher]

Hi,

I'm adding a "Price" field to each product in the events. Therefore I'm using a lookup which includes the productname and the price.

| lookup Pricelist.csv productname OUTPUT price

Is there a way to add different prices for specific timeranges? For Instance, Product A had a price of 5.00 until 24.11.2013, but for events >=25.11.2013 I would like to have a value of 3.00 in all events including product A.

Perhaps using a second lookup in combination with something like "if _time>=X lookup Pricelist2.csv productname OUTPUT price"?

Thanks in advance

[gfuente]

Hello

Probably it would be better to have only one lookup, and include the time, in epoch when the price changed. And then do a eval to see which price should be used

Regards

[yannK]

you cannot use a lookup in an eval.

if you lookup is timebased (fields _time, productname, price)

<mysearchwithfield_timeand_productname> | lookup pricelist.csv _time productname OUTPUT price | table _time productname price

[HeinzWaescher]

Is it possible to use something like this?

| eval price=if(timestamp<1385251200, [|lookup pricelist.csv productname OUTPUT price], null())

This try returns an error:

"Error in 'eval' command: The expression is malformed. An unexpected character is reached at ') , null())'"

[HeinzWaescher]

thanks for the input, I will keep that in mind. But at the moment I would prefer a fast ( and dirty) solution in the search string... 😉

[davebrooking]

Heinz

The Knowledge Manager documentation contains details on setting up a time based lookup. Take a look at http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_...

Dave

[HeinzWaescher]

Do you mean a lookup like this?

productname, price, epochtime
ProductA, 5.00, 1385251200
ProductA, 3.00, 1385337600

How can I configure the lookup command what price to add to the field with an eval command?