Purging lookup table of old entries

[saurabhkunte]

Hi All,

I have a lookup table where I am maintaining States of a field. It's rather a chatty table and grows to a large size over time. I would like to purge the entries in the lookup table older than 2 months and run this on daily schedule. How would I do that ?

The fields contain _time field which can be used to purge older rows in the lookup. Any help appreciated.

Thank you.

[kamlesh_vaghela]

@saurabhkunte,

Can you please try this search?

Execute this search for that time window span whose record you want to keep.

| inputlookup my_csv_lookup | addinfo | where ((NOT isnum(info_max_time)) OR _time > info_min_time AND _time < info_max_time)

This search will give you your expected rows in lookup.

| inputlookup my_csv_lookup | addinfo | where ((NOT isnum(info_max_time)) OR _time > info_min_time AND _time < info_max_time) | outputlookup my_csv_lookup

This search will overwrite lookup file with your expected rows.

Thanks