Splunk Search

Search with Time Using a Lookup?

atebysandwich
Path Finder

I have a lookup of hosts with a field Last_Scan_Datetime and the field values were formated using strftime(_time, "%Y-%m-%d-%H.%M.%S") . How would I go upon searching for hosts that were scanned in the last 3 days? 

Everything I've found regarding searching with time has involved searching the index. 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can make a time based lookup definition where you define the settings as

bowesmana_0-1678753775497.png

Then when you search your events, assuming your host field is called host, you do

 

| lookup your_lookup_definition host OUTPUT Last_Scan_Datetime as found_Last_Scan_Datetime
| where isnull(found_Last_Scan_Datetime)

 

which will return you all the hosts where the Last_Scan_Datetime field is older than 3 days ago from the _time field in the event for that host

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Looking up times is not straightforward.  For the most part, lookups do exact string matches (except for wildcard and CIDR matching, if defined).  Timestamps are even trickier since Splunk can't do much with them in string format.  That means something like

| inputlookup mylookup.csv where Last_Scan_Datetime > someValue

won't work.  You'd have to convert the timestamp to epoch form and then compare it.

| inputlookup mylookup.csv
| eval epoch = strptime(Last_Scan_Datetime, "%Y-%m-%d-%H:%M:%S")
| where epoch > relative_time(now(), "-3d")

This assumes your use case works with the inputlookup command.  I know of no similar solution using lookup.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...