Splunk Search

How to compare earliest and latest in inputlookup?

danutmatei
Explorer

Hello,

I have a .csv file with 2 columns: IoC and added_timestamp

I did compare the data and I get a few matches, but what I want is to use just a portion of the .csv. Based on added_timestamp column I want to compare the IoC added in .csv in the last 7 days.

Can someone help me to accomplish this ?

Thank you in advance.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming added_timestamp is already an epoch time stamp (otherwise you may need to also use strptime() to convert it to one)

.... some data

where action=allowed AND

[|inputlookup intelligence.csv

|where added_timestamp > relative_time(now(), "-7d")

|eval hash=indicator

|fields hash]

 

View solution in original post

0 Karma

danutmatei
Explorer

this is what I have:

 

.... some data

where action=allowed AND

[|inputlookup intelligence.csv

|eval hash=indicator

|fields hash]

 

That is working, but for example I don't want to compare hashes added 60 days a go. I want for example, hashes added in the last 7 days ..

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming added_timestamp is already an epoch time stamp (otherwise you may need to also use strptime() to convert it to one)

.... some data

where action=allowed AND

[|inputlookup intelligence.csv

|where added_timestamp > relative_time(now(), "-7d")

|eval hash=indicator

|fields hash]

 

0 Karma

danutmatei
Explorer

It's working, but what if, for example I want data starting from 7 days ago till 30 days ago ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Just change the where command to compare added_timestamp with two values

| where added_timestamp > relative_time(now(), "-30d") AND added_timestamp < relative_time(now(), "-7d")
0 Karma

danutmatei
Explorer

is working, thank you so much 🙂 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could read the csv (with inputlookup) and then filter by comparing the added timestamp with 7 days prior to now.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...