Splunk Search

Delete old data from lookupfile

Path Finder


I have a lookup file which will get update daily(from a scheduled search ), I need keep only last 45 days data in it, means data which is added 45 days back needs to be deleted.(we have _time field in lookup file)

Please let me know if there is any other way to store the data(which will update daily ) with out using lookup file.

Tags (1)


This (should be) fairly trivial as part of your scheduled search that creates your lookup. I assume that your lookup is created roughly as follows:

some_search_terms | inputlookup append=true lookup.csv | 
some_other_stuff | outputlookup lookup.csv

Following this paradigm, you can insert something like this before the outputlookup:

| where _time >= now() - (86400 * 45)
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...