inputlook

[kishan2356]

I have a inputlookup search where I am looking to do a current count vs four week average count. My search is set up so it uses : | inputlookup count.csv | bin _time span=5m 

I need my search to display data from prior four weeks like below.

_time	c	Last Week	Two Weeks	Three Weeks Ago	Four weeks Ago
9/19/2021 15:10	265	(Count from 9/12/2021 15:10)	(Count from 9/05/2021 15:10)
9/19/2021 15:15	362	(Count from 9/12/2021 15:15)	(Count from 9/05/2021 15:15)
9/19/2021 15:20	589	(Count from 9/12/2021 15:20)	(Count from 9/05/2021 15:20)
9/19/2021 15:25	700	(Count from 9/12/2021 15:25)	(Count from 9/05/2021 15:25)

The problem is that I would normally use earliest and latest ( but these commands do not work with inputlooks. If anyone has solutions that work for inputlook it would be great!

[PickleRick]

I don't quite understand - what exactly does your lookup contain? Can you provide us with a sample? We already have desired output but we don't know the input.

[kishan2356]

The lookup only contains counts as seen in the table I have in the original post. My problem is I can't use earliest and latest commands to view historical data week by week.

[PickleRick]

I still don't understand what are the raw contents of the lookup. Anyway, doesn't ( | inputlookup | where _time<=something AND _time>=something) work?

[bowesmana]

You can add the search window time to the event using addinfo and then filter the events on the _time value in your lookup, e.g.

| addinfo
| where _time>=info_min_time AND _time<=info_max_time

 so, if your search window is last 4 weeks, then this will return the events from the last 4 weeks only from the lookup.

Is that what you wanted?

If this is part of a dashboard search, then you could use the tokens from your time selector, e.g.

| inputlookup count.csv where _time>=$timerange.earliest$ AND _time<=$timerange.latest$

[kishan2356]

Hi bowesmana,

 How can I use 

| where _time>=info_min_time AND _time<=info_max_time

 to only display data from last 7 days (one week) if inputlook does not accept earliest and latest?

[bowesmana]

Your original post implied the lookup contained _time as a field. If you do not have a time field in your lookup then you can't filter by time. If you have a field called _time in your lookup, then do as I suggest in my previous post. There is a 3rd option which will make a fixed 7 day test (again assuming you have a time field in your lookup)

| inputlookup count.csv
| where _time>=relative_time(now(), "-7d@d") AND _time<=now()