maybe, check time-based lookup... https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Usefieldlookupstoaddinformationtoyourevents Configure a time-based lookup File-based and external lookups can also be time-based (or temporal), if the field matching depends on time information (a field in the lookup table that represents the timestamp). To Configure a time-based lookup, select Configure time-based lookup, then specify the Name of the time field. You can also specify a strptime format for this time information and offsets for the time matching. ... View more

Also, make sure that field name that contains IP ifnormation is same in both proxylogs and ipinfo index. If not that add a rename command in subsearch to make both field name same. index=ipinfo ip_s="ip" [search index=proxylogs "conditions" | stats count by ip | table ip | rename ip as ipFieldNameInipinfoIndex ] | stats values(ipinfo)... ... View more

Hi thanks, but i have windows machine. do i need to take backup of reports, alerts and advisories or splunk will automatically pick the previous version report, alerts, advisories. If yes then how? Windows machine ... View more

Hi @ivar9692 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Thanks! ... View more

Hi @ivar9692 - Did dperre's answer help solve your question at all? If yes, please don't forget to click "Accept" below the answer to resolve this post. Thanks! ... View more