Splunk Search

How to search by _time from inputlookup csv file?

mikeyty07
Communicator

I have a csv file which has data like this and i am using 
| inputlookup abc.csv | search _time >= '2023-09-10" but its is not showing any data

_time client noclient
2023-09-10 iphone airpord
2023-09-11 samsung earbud

 

how do i get the data only for the selected date like from the above query

Labels (3)
Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Now there's an odd thing with a field called "_time"

If that field in your lookup file really is called that WITH the underscore, it very much depends on what that data really is in the lookup, because Splunk will always render the _time field in a string way, not as an epoch, so if your lookup contains

 

"_time",client,noclient
"1694268000.000000",iphone,airpord
"1694354400.000000",samsung,earbud

 

then when you do inputlookup yourfile.csv it will LOOK like

2023-09-10iphoneairpord
2023-09-11samsungearbud

so in that case, the field is already in EPOCH time and you would have to go

 

| inputlookup times.csv
| where _time>=strptime("2023-09-10", "%F")

 

and you will get your results back. I suspect this is YOUR case, because ...

HOWEVER, if your lookup contains 

 

"_time",client,noclient
2023-09-10,iphone,airpord
2023-09-11,samsung,earbud

 

then that where clause will not work and you must first fix up _time.

That said, this WILL work if your data is actually strings like above

 

| inputlookup abc.csv
| search _time>="2023-09-10"

 

as you can do string comparisons IFF _time is also a string and you are using ISO8601 date format YYYY-MM-DD

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Now there's an odd thing with a field called "_time"

If that field in your lookup file really is called that WITH the underscore, it very much depends on what that data really is in the lookup, because Splunk will always render the _time field in a string way, not as an epoch, so if your lookup contains

 

"_time",client,noclient
"1694268000.000000",iphone,airpord
"1694354400.000000",samsung,earbud

 

then when you do inputlookup yourfile.csv it will LOOK like

2023-09-10iphoneairpord
2023-09-11samsungearbud

so in that case, the field is already in EPOCH time and you would have to go

 

| inputlookup times.csv
| where _time>=strptime("2023-09-10", "%F")

 

and you will get your results back. I suspect this is YOUR case, because ...

HOWEVER, if your lookup contains 

 

"_time",client,noclient
2023-09-10,iphone,airpord
2023-09-11,samsung,earbud

 

then that where clause will not work and you must first fix up _time.

That said, this WILL work if your data is actually strings like above

 

| inputlookup abc.csv
| search _time>="2023-09-10"

 

as you can do string comparisons IFF _time is also a string and you are using ISO8601 date format YYYY-MM-DD

richgalloway
SplunkTrust
SplunkTrust

Splunk cannot compare timestamps as strings.  They must be converted to epoch (integer) form first.

| inputlookup abc.csv 
| eval _time = strptime(_time, "%Y-%m-%d")
| search _time >= strptime("2023-09-10", "%Y-%m-%d")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...