Splunk Search

Displaying data that is missing from a lookup table

mlg
Observer
Hi, I am new to Splunk and working with parking records. I am trying to display parking spaces that are currently not in use.
 
Within my monitored data each record has the following fields:
  1. the time data was created, which is when the car parked
  2. permit_expiry, which is a couple of hours after the creation time
  3. parking_space, which is a number between 1 and 99, that doesn't repeat until the permit_expiry has passed.
I also have a separate lookup table/csv file called parking_lots of all parking_space (1-99), and their respective parking_lot.
 
This is what I have come up with so far:
sourcetype="parking_log"
| where now() < expiry_time
| lookup parking_lots parking_space
| *display parking_space that don't appear in the above search (1-99)*

I am struggling to understand how to display the parking spaces, as well as use of the now() function.
Many thanks!
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
sourcetype="parking_log"
| where now() < expiry_time
| append [| inputlookup parking_lots]
| stats values(expiry_time) as expiry_time by parking_space
| where isnull(expiry_time)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...