Splunk Search

how can i make up lookup table by time

nopvirus
Loves-to-Learn Lots

Hi. 

I have a question.

the below as lookup table for example.

 

value | data | time

1111| 2222 | 12312313 (epoch time)

 

in this situation, Can ttl be configured using epoch time fields? The epoch time is the time when the value is registered. i know what there is exist that "Configure time-based lookup" on lookup table.

Can I use this to configure ttl? I would like to use a lookup table for about a month.

Thanks.

 

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...