We have been able to successfully use inputlookup with lookup files we have created. However, our lookup files have timestamps that are not being picked up by splunk despite annotating it in the transforms.conf. We are not currently using automatic lookups. Here is an example of our setup: The below is our "lookup" csv file test.csv date,interesting_data 2012-11-09 09:32:34,things that occurred and then this is in our transforms.conf transforms.conf [test_lookup_file] filename = test.csv time_field = date time_format = %Y-%m-%d %H:%M:%s We can invoke the inputlookup and return all of the data,but its time is exactly when we did the search IE: |inputlookup test_lookup_file | _time returns nothing |inputlookup test_lookup_file | table date interesting_data returns all of the data in the lookup file. My assumption is that I am either A: not understanding exactly how temporal lookup files work or B: have a really stupid mistake somewhere. Any help would be greatly appreciated. Please note, that my data has been sanitized an reviewed, so any typos that exist above are my own fault and not what is currently in the system ... View more