Splunk Search

How to update a lookup table for specific rows?

nazanin2016
Path Finder

I need to keep the name of all systems that have been detected for phishing in order to use it in another search,
so I update my lookup table with scheduled search as follow:

inputlookup phishing.csv | append [look for phishing logs]| outputlookup phishing.csv

I used append command to keep the previous rows, but I just need to keep each raw only for 1 week from the time it has been added to table (I mean give the time to live=1h)

Any idea?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this. This will add a column called addedtime to all rows with the time they were added (using scheduled search). The where filter will remove rows older than 1 week from now.

inputlookup phishing.csv | append [look for phishing logs ] | eval addedtime=coalesce(addedtime,now()) | where addedtime>relative_time(now(),"-1w") | outputlookup phishing.csv

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try like this. This will add a column called addedtime to all rows with the time they were added (using scheduled search). The where filter will remove rows older than 1 week from now.

inputlookup phishing.csv | append [look for phishing logs ] | eval addedtime=coalesce(addedtime,now()) | where addedtime>relative_time(now(),"-1w") | outputlookup phishing.csv

nazanin2016
Path Finder

Great,thx,but then shouldn't we say where addedtime <

0 Karma

nazanin2016
Path Finder

Great,thx,but then shouldn't we say where addedtime

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I didn't get it. Did portion of your comment got truncated?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...