Splunk Search

Maintenance Time query help

tchintam
Path Finder

Hi,

I'm using a lookup which stores maintenance periods and can be used to exclude events of downtime from my main query.

My Lookup looks this way:

Numbers StartDateTime EndDateTime
1 2014/01/21 01:00:00 2014/01/22 01:00:00
2 2015/02/21 02:00:00 2014/01/23 01:00:00

The query that I've used is:

|base query|[ | inputlookup mainteinance_time | eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S")
| eval time="NOT (_time>"+start+" AND _time<"+end+")"
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search

This is returning me the correct events. The only problem over here is I'm having the pass the number of rows in the lookup in the "return" function before $time. Is there a way I can recursively do it without having to mention the number? Like calculating the number of rows present and passing the value? How do I build my query on those lines?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...