Splunk Search

How to get the latest entry from a lookup table?

mcram52
New Member

I'm creating a chart which includes the use of a lookup table file, but I only want it to pull up the latest entry for a field. How would I do this? So far I just have this:

| lookup Packaging_User_Targets.csv Username as username OUTPUT Daily_Individual_Goal as Target
| fields username Completed Target

Right now this is pulling up all the 'Target' results for that user, including previous days, but I only want it to include the results from that day. Sorry if this is a repeat, I'm new and having a hard time trying to use answers from different situations.

Tags (4)
0 Karma

woodcock
Esteemed Legend

The easiest way is to create a time-based lookup definition against your existing lookup file:

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Defineatime-basedlookupinSplunkWeb

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...