How to compare earliest and latest in inputlookup?

[danutmatei]

Hello,

I have a .csv file with 2 columns: IoC and added_timestamp

I did compare the data and I get a few matches, but what I want is to use just a portion of the .csv. Based on added_timestamp column I want to compare the IoC added in .csv in the last 7 days.

Can someone help me to accomplish this ?

Thank you in advance.

[danutmatei]

this is what I have:

.... some data

where action=allowed AND

[|inputlookup intelligence.csv

|eval hash=indicator

|fields hash]

That is working, but for example I don't want to compare hashes added 60 days a go. I want for example, hashes added in the last 7 days ..

[ITWhisperer · Accepted solution]

Assuming added_timestamp is already an epoch time stamp (otherwise you may need to also use strptime() to convert it to one)

.... some data

where action=allowed AND

[|inputlookup intelligence.csv

|where added_timestamp > relative_time(now(), "-7d")

|eval hash=indicator

|fields hash]

[danutmatei]

It's working, but what if, for example I want data starting from 7 days ago till 30 days ago ?

[ITWhisperer]

Just change the where command to compare added_timestamp with two values

| where added_timestamp > relative_time(now(), "-30d") AND added_timestamp < relative_time(now(), "-7d")

[danutmatei]

is working, thank you so much 🙂 

[ITWhisperer]

You could read the csv (with inputlookup) and then filter by comparing the added timestamp with 7 days prior to now.