Splunk Search

last 7 days on an input lookup

Sfry1981
Communicator

I have the below query where i want all closed dates counted by the last 7 days but the below is not working

| inputlookup int_case | search  closeddate!=null
| where _time>=relative_time(now(),"-1w") AND _time<=now() | stats count

This brings back 0. When i remove the the where search i get all the results. I find that Splunk seems to hate input lookups and you have to hack all your searches to get it to work correctly.

Any advice on how to do this is appreciated

Tags (1)
0 Karma
1 Solution

gaurav_maniar
Builder

Hi,

The data that is stored as lookup is not time dependent. So whenever you execute any search including lookups, it will result all matching results for the lookup irrespective of time.

One way to limit lookup based on time is to store date & time stamp as a column while creating lookup.

If your closeddate field is timestamp string, than it can be easily done by below query,

| inputlookup int_case | search  closeddate!=null
| eval _time = strptime(closeddate, "time stamp format of closeddate")
| where _time>=relative_time(now(),"-1w") AND _time<=now() | stats count

time stamp format example - "%Y-%m-%d %H:%M:%S"

Please upvote and accept the answer if it helps.

View solution in original post

gaurav_maniar
Builder

Hi,

The data that is stored as lookup is not time dependent. So whenever you execute any search including lookups, it will result all matching results for the lookup irrespective of time.

One way to limit lookup based on time is to store date & time stamp as a column while creating lookup.

If your closeddate field is timestamp string, than it can be easily done by below query,

| inputlookup int_case | search  closeddate!=null
| eval _time = strptime(closeddate, "time stamp format of closeddate")
| where _time>=relative_time(now(),"-1w") AND _time<=now() | stats count

time stamp format example - "%Y-%m-%d %H:%M:%S"

Please upvote and accept the answer if it helps.

Sfry1981
Communicator

Thanks @gaurav_maniar

Worlds like a dream 🙂

0 Karma

gaurav_maniar
Builder

please upvote the answer as well.
thanks

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...