Hello Splunk Answers! I'm relatively new to Splunk - pardon if this is a very basic question. I've looked through previous answers without luck. I'm trying to query Splunk Enterprise Security notable events by using inputlookup es_notable_events , and also trying to slim down results with an earliest and latest filter: | inputlookup es_notable_events | earliest=-1h latest=now However, this doesn't do the trick. How can I use inputlookup with earliest and latest ? Thank you for looking and any help you might be able to offer! ... View more