Splunk Search

All fields from a lookup.csv file appear except the date field?

boris
Path Finder

All fields from a lookup.csv file appear as available search fields except the date field.

Here is how I defined the start_date field in my lookup.csv file:

'2012-03-12 20:10'

%Y-%m-%d %H:%M

So how can I get this start_date field to appear as a potential field in my searching here?

0 Karma
1 Solution

boris
Path Finder

After looking at the raw .csv of the lookup file I see the dates were formatted differently then I expected.

View solution in original post

0 Karma

boris
Path Finder

After looking at the raw .csv of the lookup file I see the dates were formatted differently then I expected.

0 Karma

boris
Path Finder

Thanks MarioM. After looking at the raw .csv of the lookup file I see the dates were formatted differently then I expected.

0 Karma

MarioM
Motivator

can you post an extract of your lookup.csv with the header?

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...