I'm creating a chart which includes the use of a lookup table file, but I only want it to pull up the latest entry for a field. How would I do this? So far I just have this:
| lookup Packaging_User_Targets.csv Username as username OUTPUT Daily_Individual_Goal as Target
| fields username Completed Target
Right now this is pulling up all the 'Target' results for that user, including previous days, but I only want it to include the results from that day. Sorry if this is a repeat, I'm new and having a hard time trying to use answers from different situations.
The easiest way is to create a time-based lookup definition against your existing lookup file:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Defineatime-basedlookupinSplunkWeb