Splunk Search

Inputlookup

chuck_life09
Path Finder

Hi, 

I have the below lookup file 

sbl.csv

It has 3 rows 

1. A=1, B = " Added" , C= 31/3/2021 04:16pm

2. .A=1, B = " Added" , C= 31/3/2021 04:45pm

3. . A=1, B = " Removed" , C= 31/3/2021 04:57pm.

Now if I give a search

|inputlookup sbl.csv | stats latest(B) as status by A 

I should get 1 , Removed

but I am getting 1, Added 

Why is that, can anyone help? 

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @chuck_life09,

When I test with your sample data it works. Maybe your time format is different than the sample?

latest/earliest function needs _time field in epoch time.  Since your lookup has no _time field, latest/earliest function have no effect.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

chuck_life09
Path Finder

Thanks this worked... 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @chuck_life09,

Easier way to do without a subsearch;

| inputlookup sbl.csv
| eval _time=strptime(C,"%d/%m/%Y %I:%M%p") 
| stats latest(B) as status by A
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

chuck_life09
Path Finder

Hi @scelikok 

Still I am not getting A= 1 and B = removed

It is still taking only the first row item. 

Why is it that stats latest won't work within inputlookup? 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @chuck_life09,

you can use the latest option on a date and in epochtime not on another field.

So you have to convert C in epochtime and use that timestamp to extract the fields you need, something like this:

| inputlookup sbl.csv 
| search [ | inputlookup sbl.csv | eval C_epoch=strptime(C,"%d/%m/%Y %I:%M%p") | stats latest(C_epoch) AS C_epoch BY A | eval C=strftime(C_epoch,"%d/%m/%Y %I:%M%p") | fields C ]
| table A B C

Ciao.

Giuseppe

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...