How to filter on KV Store lookup time-based fields using a time picker?

[nawneel]

I have a large data set in my KV Store collections. These fields also contains time specific fields. I would like to perform filtering on these time based fields by time picker. Any suggestions for implementation.

[woodcock · Accepted solution]

Like this:

| inputlookup MyKVstoreName | addinfo | where MyTimeField >= info_min_time AND MyTimeField <= info_max_time

[nawneel]

This Works wonders . thanks @woodcock

[tnesavich_splun]

Perfect Gregg! Thanks for this. Elegant and effective.

[frechette]

This isn't elegant, it's inefficient. You should be able to filter by time before results are ever brought into the search pipeline.

[dnitschke_splun]

You can also add the time filter into the WHERE clause of inputlookup, e.g.

| inputlookup MyKVstoreName WHERE
[| makeresults count=1
| addinfo
| eval info_max_time=if(info_max_time=="+Infinity", 2147483647, info_max_time)
| eval search="( (MyTimeField>=" . info_min_time . ") AND (" . "MyTimeField<" . info_max_time . ") )"
| table search ]

[woodcock]

I am full of IT, ask anybody.