Splunk Search

Can not searching by date in inputlookup es_notable_events

Dmitriy
Explorer

Hi, please help to make search by date in inputlookup "es_notable_events". I thried to search by "earliest" its not work. 

Dmitriy_1-1623311243178.png

 

Labels (1)
0 Karma

Dmitriy
Explorer

Thanks for help

0 Karma

Dmitriy
Explorer

I found the way how to search

| inputlookup es_notable_events | eval last_modified_timestamp=_time
| eval myTime=relative_time(time(),"-1h")
| where last_modified_timestamp>myTime
| fields - time
|search rule_name="Threat Activity Detected"

0 Karma

rupkumar4sec
Path Finder

I don't think you can use earliest and latest in inputlookup. Try this

| where ( _time >= <earliest time> AND  _time <= <latest time>)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!