Why am I getting error "Invalid time bounds in search" using inputlookup on a CSV file containing date ranges?

[abbam]

Hi,

I'm trying to run this search:

index="proxy" [|inputlookup TEST.csv | return 2 $IPs $dates]

My TEST.csv file has the following:

IPs           dates
10.10.10.10   earliest=11/27/2015:10:00:00 latest=11/27/2015:11:00:00
10.10.10.2  earliest=11/26/2015:10:30:00 latest=11/26/2015:11:30:00

I'm getting the following error:

Error in 'litsearch' command: Unable to parse the search: Invalid time bounds in search: start=1450255314 > end=1448622000. 

If I remove the 2 in the search, so that it's like:

index="proxy" [|inputlookup TEST.csv | return $IPs $dates]

it only returns the first row in my CSV and doesn't parse the second one.

Is there a problem with my CSV, or is there a better way to do this? I have a list of about 150~ entries.

Any help would be great.

Thanks.

[jmallorquin]

Hi abbam,

One possible solution could be find first in the subsearch of the lookup the min epoch earliest and the max epoch of latest just to define the time to search.

index="proxy" [|inputlookup TEST.csv |rex field=dates "earliest=(?<date_ear>[^\s]+)" |rex field=dates "latest=(?<date_lat>[^\s]+)" | eval epoch_earliest = strptime(date_ear,"%m/%d/%Y:%H:%M:%S") | eval epoch_latest = strptime(date_lat,"%m/%d/%Y:%H:%M:%S") | stats min(epoch_earliest) as earliest max(epoch_latest) as latest | eval earliest = "earliest=".earliest | eval latest = "latest".latest| return $earliest $latest] | search [|inputlookup TEST.csv | table IPs]

Hope help you.

[abbam]

This only searches for the first date in the CSV file - I have multiple dates against multiple IPs that I watch to search.

For example:

TEST.csv
IP DATE
10.10.10.10 earliest=11/27/2015:10:00:00 latest=11/27/2015:11:00:00
10.10.10.2 0 earliest=10/23/2015:10:00:00 latest=10/27/2015:11:00:00

I want it to search both of the rows and show me the results in one splunk query.

Thanks,

[jkat54]

I think the issue is you're returning values that look like fields and then Splunk gets confused. You need field names that dont match splunk internal fields. "earliest" and "latest" need to be renamed, and should have the key=value format... instead the csv header should be where the key comes from, and the value should be just that.. the value.

In your example, $dates equals "earliest=blah latest=blah"

should be somethng like $IP, $EARLIEST, $LATEST so that:

$earliest = blah
$latest = blah

And your csv should look like this
ip,earliest,latest
10.0.0.1,12/16/2015 12:00:00,12/17/2015 12:00:00

[abbam]

Thanks for the comment, however, that didn't work.

[jmallorquin]

Hi,

The problem is that you can not make the same search with diferent time period in the same time.

What are you trying to do?

Regards,

[abbam]

I am trying to search for multiple IP address between specific time ranges that are listed in the CSV file.

Is there anyway I can do this?