Splunk Search

time-based lookups using db connect

rdownie
Communicator

I specified a field in the lookup definitions to use with a lookup command (database lookup) and it appears not to work? Is there any documentation out there on using a field that the database lookup returns in conjunction with time-based (splunk standard timepicker) queries?
Thanks,
-Bob

1 Solution

araitz
Splunk Employee
Splunk Employee

I don't believe it works in DBX 1.1, but we'll consider adding it in a future release.

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

I don't believe it works in DBX 1.1, but we'll consider adding it in a future release.

0 Karma

rdownie
Communicator

The UI under lookup definition allows you to set up time based lookups for database lookups. It shouldn't be in the UI if it is not supported. (I realize it is also there for file based lookup tables but there should be a distinction if the feature isn't there).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

Build and Launch AI Agents from Your Splunk Workflows

  Register We’ve all been there: juggling alerts, runbooks, and endless manual searches. What if you could ...

Splunk Cloud Application Management in Terraform

Register   On Tuesday, August 4 at 11AM PDT / 2PM EDT, we’re diving into how you can bring Infrastructure as ...