- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mark_cet
Path Finder
02-01-2023
10:44 AM
Hi,
I have a lookup table that contains a list of sessions with permitted time frames (start day & time / end day & time). I am looking for a way to run a scheduled search to remove any expired entries from the lookup table (e.g. sessions with end days / times that have passed).
Can multiple entries be removed from a lookup table via a search? I know I can append to a lookup table but not sure about deletion.
Thanks!
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
isoutamo

SplunkTrust
02-01-2023
10:54 AM
Hi
basically you create a scheduled search which will do it. Here is one example from community
- read old with inputlookup
- append it to your normal seach
- filter out unwanted entries
- store it back to lookup file with outputlookup
- Be sure that in problem situations you don't get empty file!
r. Ismo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
isoutamo

SplunkTrust
02-01-2023
10:54 AM
Hi
basically you create a scheduled search which will do it. Here is one example from community
- read old with inputlookup
- append it to your normal seach
- filter out unwanted entries
- store it back to lookup file with outputlookup
- Be sure that in problem situations you don't get empty file!
r. Ismo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mark_cet
Path Finder
02-04-2023
06:22 AM
Thank you very much for this isoutamo! I will give it a try.
