Using timechart earliest/latest with lookup files

[lewisgrantevans]

Hi all,

I've created a _time field and timechart works for me, but the earliest/latest command does not. Here is my search -

| inputlookup mylookupfile.csv
| eval _time=strptime(Created,"%d/%m/%Y %H:%M")
| search Platform=ABC
| timechart span=1d dc("Issue key") AS "Count of Issue key"

As expected, I get all results from Sept 2018 to now in a timechart, in one day buckets. However, i'm trying to only show the previous week. The time range presets don't work. I have also tried many variations of the following -

| search earliest=-7d@d latest=-1d@d
| search earliest=-7d latest=-1d
| search earliest=-1w@w latest=-0w@w
| search _time earliest=-7d@d latest=-1d@d
| search _time earliest=-7d latest=-1d
| search _time earliest=-1w@w latest=-0w@w

I get zero results.

Is there any way to do this? I feel like i've read all of the other articles with similar issues but haven't found an answer that works for me.

Thanks!

[gcusello]

Hi lewisgrantevans,
if you want to use the time picker, you cannot use lookups, did you explored the choice of summary indexes?
they are indexes with timestamp and all the fields you have in lookup, in other words they are lookups with a timestamp, they are very quick and don't consume license.
So you can schedule a search (the same that populates your lookup) and write results in a summary index adding as last row | collect index=my_summary .
Then you can search on this summary index.

Bye.
Giuseppe

[jacobpevans]

Greetings @lewisgrantevans,

Have you tried just setting the time picker via GUI? I believe the timechart uses those values for what it displays.

Cheers,
Jacob