Splunk Search

How do you view the last event time in an inputlookup?

vatsalyay
New Member

I have an inputlookup which searches on a CSV where the CSV looks like

Field_A Field_B
A          test1
B          test2

I want to run a search where I get the output but I also get a column added to see what was the last event observed from Field A in Splunk with an output like

Field_A Field_B Last_event
A          test1    9/22/18 7:28:16
B          test2    9/25/18 7:28:16

I have written a query but it does not seem to work:

inputlookup excel.csv | table Field_A   Field_B | appendcols [search index=my_index  src=Field_A| stats head 1 | stats first(_time)| eval Last_Seen_Event=strftime(Last_Seen_Event,"%+")]
0 Karma

somesoni2
Revered Legend

You can do like this

index=my_index  [| inputlookup excel.csv | table Field_A | rename Field_A as src ]
| stats max(_time) as Last_Seen_Event by src | rename src as Field_A
| inputlookup append=t excel.csv 
| stats values(Last_Seen_Event) as Last_Seen_Event values(Field_B) as Field_B by Field_A
| eval Last_Seen_Event=strftime(Last_Seen_Event,"%+")
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...