Splunk Search

How to search by _time from inputlookup csv file?

mikeyty07
Communicator

I have a csv file which has data like this and i am using 
| inputlookup abc.csv | search _time >= '2023-09-10" but its is not showing any data

_time client noclient
2023-09-10 iphone airpord
2023-09-11 samsung earbud

 

how do i get the data only for the selected date like from the above query

Labels (3)
Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Now there's an odd thing with a field called "_time"

If that field in your lookup file really is called that WITH the underscore, it very much depends on what that data really is in the lookup, because Splunk will always render the _time field in a string way, not as an epoch, so if your lookup contains

 

"_time",client,noclient
"1694268000.000000",iphone,airpord
"1694354400.000000",samsung,earbud

 

then when you do inputlookup yourfile.csv it will LOOK like

2023-09-10iphoneairpord
2023-09-11samsungearbud

so in that case, the field is already in EPOCH time and you would have to go

 

| inputlookup times.csv
| where _time>=strptime("2023-09-10", "%F")

 

and you will get your results back. I suspect this is YOUR case, because ...

HOWEVER, if your lookup contains 

 

"_time",client,noclient
2023-09-10,iphone,airpord
2023-09-11,samsung,earbud

 

then that where clause will not work and you must first fix up _time.

That said, this WILL work if your data is actually strings like above

 

| inputlookup abc.csv
| search _time>="2023-09-10"

 

as you can do string comparisons IFF _time is also a string and you are using ISO8601 date format YYYY-MM-DD

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Now there's an odd thing with a field called "_time"

If that field in your lookup file really is called that WITH the underscore, it very much depends on what that data really is in the lookup, because Splunk will always render the _time field in a string way, not as an epoch, so if your lookup contains

 

"_time",client,noclient
"1694268000.000000",iphone,airpord
"1694354400.000000",samsung,earbud

 

then when you do inputlookup yourfile.csv it will LOOK like

2023-09-10iphoneairpord
2023-09-11samsungearbud

so in that case, the field is already in EPOCH time and you would have to go

 

| inputlookup times.csv
| where _time>=strptime("2023-09-10", "%F")

 

and you will get your results back. I suspect this is YOUR case, because ...

HOWEVER, if your lookup contains 

 

"_time",client,noclient
2023-09-10,iphone,airpord
2023-09-11,samsung,earbud

 

then that where clause will not work and you must first fix up _time.

That said, this WILL work if your data is actually strings like above

 

| inputlookup abc.csv
| search _time>="2023-09-10"

 

as you can do string comparisons IFF _time is also a string and you are using ISO8601 date format YYYY-MM-DD

richgalloway
SplunkTrust
SplunkTrust

Splunk cannot compare timestamps as strings.  They must be converted to epoch (integer) form first.

| inputlookup abc.csv 
| eval _time = strptime(_time, "%Y-%m-%d")
| search _time >= strptime("2023-09-10", "%Y-%m-%d")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...