Splunk Search

How do I filter events by lookup time?

imheejin
Explorer

I have a lookup table like in splunk this:

earliest_timelatest_timeS_NOSRC_IP
3/1/20214/1/2021E100210.10.10.10

 

I want to exclude the SRC_IP within time(earliest_time and  latest_time) from the search.

How could I write the splunk sql to implement this?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

your search
| lookup lookup-table-name IP OUTPUT earliest_time latest_time
| eval earliest_time=strptime(earliest_time,"%m/%d/%Y)
| eval latest_time=strptime(latest_time,"%m/%d/%Y)
| where _time < earliest_time OR _time > latest_time

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

your search
| lookup lookup-table-name IP OUTPUT earliest_time latest_time
| eval earliest_time=strptime(earliest_time,"%m/%d/%Y)
| eval latest_time=strptime(latest_time,"%m/%d/%Y)
| where _time < earliest_time OR _time > latest_time
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!