Splunk Search

Timestamp comparison from an inputlookup

DomenicoFumarol
Explorer

Hi All,
I do have cumbersome problem...I have a table built out from an inputlookup search. We have n-columns in this table but a key ones are the key_field and a timestamp_A.
We would like to run a subsearch within the inputlookup where, for each value in key_field, we check the most recent value of a timestamp_B in another index. If this value is more recent than the one in timestamp_A we update the timestamp value with the B value, otherwise we leave the timestamp_A.
Assuming that both timestamps are in the same format we have the following restrictions: the value in timestamp_A might be empty, in this case if exist a timestamp_B value OK otherwise we leave empty.

Very much appreciated any help that could be provided.

0 Karma

manjunathmeti
Champion

Try this:

| inputlookup lookup_name | fields key_field, timestamp_A | append [search index=index_name | stats max(timestamp_B) as timestamp_A by key_field] | stats max(timestamp_A) as timestamp_A by key_field
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...