Hello all,
I'm using a lookup table with a _time field to create a timechart which works great.
However, the lookup table has data for say 90 days and I don't always want the timechart to be for the full 90 days.
How can I limit my timechart to 30 days from my lookup table that has 90 days worth of data without deleting the extra 60 days?
The _time field is in already in the format %y-%m-%d %H:%M
I've tried
|inputlookup mylookupfile where earliest=-30d
Thank you!
The queries allowed in the where clause of inputlookup are different from those allowed in the search command. In particular, "earliest" in search maps to the _time field whereas in inputlookup it refers to the "earliest" field.
A further complication is inputlookup where does not recognize time modifiers.
One workaround is to read the entire lookup, convert _time to epoch form, then compare the converted time to the timestamp 30 days old.
| inputlokoup mylookup
| eval eTime=strptime(_time, "%Y-%m-%d %H:%%M")
| where eTime > relative_time(now(), "-30d")
| fields - eTime
The queries allowed in the where clause of inputlookup are different from those allowed in the search command. In particular, "earliest" in search maps to the _time field whereas in inputlookup it refers to the "earliest" field.
A further complication is inputlookup where does not recognize time modifiers.
One workaround is to read the entire lookup, convert _time to epoch form, then compare the converted time to the timestamp 30 days old.
| inputlokoup mylookup
| eval eTime=strptime(_time, "%Y-%m-%d %H:%%M")
| where eTime > relative_time(now(), "-30d")
| fields - eTime