Splunk Search

Lookup Definition using Match Type

Explorer

I am attempting to create a new "Week" field based on an external lookup.

However, the date field in my sourcetype and lookup DO NOT match. The date field in the sourcetype is in following format %d/%m/%Y %H:%M (e.g. 31/05/2018 00:05). The Date field in my lookup table is in following format %d/%m%/Y (e.g. 31/05/2018).

Can I use Match Type in lookup definition to use a wildcard on Date field in order to return "Week" field? Can't seem to get it to work.

Thanks,
Jack

0 Karma

Esteemed Legend

That feature does not work anything like what you need. Skip the lookup and just use something like this:

|makeresults | eval date="31/05/2018 00:05"
| eval _time = strptime(date, "%d/%m/%Y %H:%M")
| eval week=strftime(_time, "%Y-W%0W-%0w")
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!