How is the maximum offset used in my time-based lookup search?

[HeinzWaescher]

Hi,

I've created time-based lookup definition which I want to use in my search. The example.csv has a time field "timestamp" and the maximum offset is 1800.

 sourcetype=A
 | lookup example.csv key OUTPUT flag

How is the maximum offset used here? In the results, every event is flagged, not only the events during the maximum offset.

BR

Heinz

[sowings]

In order for the lookup to be time-based, it must also include a "time_field" value within the transforms.conf definition. Given your description of the behavior, it sounds like you're not triggering a time-based lookup, or the time-stamp is not within the format specified in your time_format option within transforms.conf. If this setting is not provided, Splunk assumes that the time field is in epoch time.

[vasanthmss]

Hi Heinz,

There is no row or column limitation on lookup table. default size is 10MB.

Refer the post Link

Cheers!