Splunk Search

Can not searching by date in inputlookup es_notable_events

Dmitriy
Loves-to-Learn Lots

Hi, please help to make search by date in inputlookup "es_notable_events". I thried to search by "earliest" its not work. 

Dmitriy_1-1623311243178.png

 

Labels (1)
0 Karma

Dmitriy
Loves-to-Learn Lots

Thanks for help

0 Karma

Dmitriy
Loves-to-Learn Lots

I found the way how to search

| inputlookup es_notable_events | eval last_modified_timestamp=_time
| eval myTime=relative_time(time(),"-1h")
| where last_modified_timestamp>myTime
| fields - time
|search rule_name="Threat Activity Detected"

0 Karma

rupkumar4sec
Path Finder

I don't think you can use earliest and latest in inputlookup. Try this

| where ( _time >= <earliest time> AND  _time <= <latest time>)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!