Splunk Search

Search two fields in one csv lookup

ocampocliff1
Engager

I want to use fields two fields that i have inside the lookup,

Inside my lookup i have "account" and "date"

basically i want to do is to search the account with the date which is greater than today.

Tags (1)
0 Karma

adonio
Ultra Champion

alt text

alt text

0 Karma

adonio
Ultra Champion

Hello ocampocliff1,
here is the csv i created:
alt text

if the date format is different on your end, you will have to change the time format in the eval statements. you can find the formats here: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables

using this search:

| inputlookup accounts.csv 
 | eval new_time = strptime(date, "%m/%d/%Y") 
 | eval c_time=strftime(new_time,"%m/%d/%y %H:%M:%S") 
 | eval now = now() 
 | where new_time > now 
 | table account, c_time 

i got this:

alt text

you can play with the | where clause as you please to find accounts on a time frame

Hope it helps

adonio
Ultra Champion

couldn't edit the answer to show screenshots. they are in the answer below

0 Karma

ocampocliff1
Engager

Hi adonio,

Thanks for this one!

I'm using this concept now. :slightly_smiling_face:

0 Karma

adonio
Ultra Champion

you are welcome!
if that answers, can you mark as "answered"?
thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...