Splunk Search

How to not Display Data that is less than 10 days old?


Hello all,

I know this has been asked many different ways but, I cant seem to get the search correct. 

I am attempting to "Don't Display Data that is less than 10 days old. I have to set-up a whitelist via a look table, the idea here is we add IP's or URL that show no threat, so want to stop seeing alerts coming in. But - we want to recheck the data again in 10 days.

This is my test search, But it still shows IP or URL's in the lookup table.




| from datamodel:"Threat_Intelligence"."Threat_Activity" 
| search NOT [| inputlookup my_whitelist.csv | fields threat_match_value] 
| where lastSeen>=relative_time(now(),"-10d") AND _time<=now()
| table _time threat_match_value




My look table fields are 


Labels (2)
Tags (1)
0 Karma


What fields are returned by your initial search?

The search NOT line will expand to a set of equalities such as 'threat_match_value = "xyz"' OR 'threat_match_value = "abc"', so unless you have a find in your initial search called threat_match_value, this line is unlikely to perform as you might be expecting

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...