Splunk Search

Is it possible to create a lookup that pulls from in a query?

jeffh2022
New Member

I've got a query I want to run on a daily basis, and write the results to a lookup (# of results once per day)

then, I want to be able to query that lookup to pull the last 7 days counts.

Is this possible? Is there a better way?

I have a lookup file of IDS exclusions I am constantly updating and I want to be able to see how many results from the search I had each day; if I run the search at the end of the 7 days it wont be accurate because it would be against the lookup after 7 days of updates, so if I had 20 results on Monday and put something in the lookup that excluded those 20, I wouldn't have visibility when I ran it the next day since the lookup would exclude those 20 results.

I was thinking if I could store the count somewhere each day and query that later, I wouldn't need to run anything against the exclusions lookup, I could just pull the historical counts I wrote.

 

Sorry if I am overcomplicating this, I'm new to Splunk so if there is a better way to do it please let me know!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you include the date that the counts apply to in the lookup file with the counts?

0 Karma

jeffh2022
New Member

I'm not opposed to it, I'd imagine I need something to tell the 2nd query what results to pull, like when there are 30 days worth and I only want the last 7, I just dont know what that would look like.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...