Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to update a lookup table for specific rows...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to keep the name of all systems that have been detected for phishing in order to use it in another search,
so I update my lookup table with scheduled search as follow:
inputlookup phishing.csv | append [look for phishing logs]| outputlookup phishing.csv
I used append command to keep the previous rows, but I just need to keep each raw only for 1 week from the time it has been added to table (I mean give the time to live=1h)
Any idea?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this. This will add a column called addedtime to all rows with the time they were added (using scheduled search). The where filter will remove rows older than 1 week from now.
inputlookup phishing.csv | append [look for phishing logs ] | eval addedtime=coalesce(addedtime,now()) | where addedtime>relative_time(now(),"-1w") | outputlookup phishing.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this. This will add a column called addedtime to all rows with the time they were added (using scheduled search). The where filter will remove rows older than 1 week from now.
inputlookup phishing.csv | append [look for phishing logs ] | eval addedtime=coalesce(addedtime,now()) | where addedtime>relative_time(now(),"-1w") | outputlookup phishing.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great,thx,but then shouldn't we say where addedtime <
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great,thx,but then shouldn't we say where addedtime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I didn't get it. Did portion of your comment got truncated?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
