Splunk Search

Why is my lookup(.CSV) search not filtering results?


I have a CSV lookup table that has 14,610 rows. I want to filter the lookup, so when I use it in my main query, it is looking at <1000 rows. The file is a list of all dates with various date information (quarter, day of week, etc.). I want only the rows from 2017 to the current year.

This is what the file looks like:


This is my query:

| inputlookup d_date_dimensions.csv 
| fields date_value year calendar_quarter
| eval current_year=strftime(now(), "%Y")
| search year>=2017 AND year<=current_year

The results I get are all rows for the year 2017 and higher (8,400 rows). I expect only 730 rows (years 2017 and 2018 rows).

The below two search lines WORK, so I'm not sure why the current_year value used above wouldn't work.

| search year>=2017 AND year<=2018  

| search year>=2017 AND year<="2018"
0 Karma

Re: Why is my lookup(.CSV) search not filtering results?


I think current_year is treated as a character string.
Please try using the WHERE clause or specify a direct value("2018").

0 Karma