What about creating a subsearch that generates the constraints for the WHERE clause of the inputlookup command. Your requirement 2700<=now()-Last_PA_Send is equivalent to Last_PA_Send<=now()-2700 . | inputlookup my_kvstore WHERE [| makeresults count=1| eval max_delta=now()-2700 | eval search="(Last_PA_send<=" . max_delta . ")" | table search ] ... View more

In case your lookup file contains time in seconds since the epoch, you can also add the time filter into the WHERE clause of inputlookup , e.g. | inputlookup Product_Status.csv WHERE [| makeresults count=1 | addinfo | eval info_max_time=if(info_max_time=="+Infinity", 2147483647, info_max_time) | eval search="( (_time>=" . info_min_time . ") AND (" . "_time<" . info_max_time . ") )" | table search ] ... View more

You can also add the time filter into the WHERE clause of inputlookup , e.g. | inputlookup testkv WHERE [| makeresults count=1 | addinfo | eval info_max_time=if(info_max_time=="+Infinity", 2147483647, info_max_time) | eval search="( (ts>=" . info_min_time . ") AND (" . "ts<" . info_max_time . ") )" | table search ] ... View more

You can also add the time filter into the WHERE clause of inputlookup , e.g. | inputlookup MyKVstoreName WHERE [| makeresults count=1 | addinfo | eval info_max_time=if(info_max_time=="+Infinity", 2147483647, info_max_time) | eval search="( (MyTimeField>=" . info_min_time . ") AND (" . "MyTimeField<" . info_max_time . ") )" | table search ] ... View more

In Splunk 7.2.x opening an external link in a new tab from the app navigation bar works. Example data/ui/nav/default.xml file including a link to the Splunk Developer Portal: <nav search_view="search"> <view name="search" default='true' /> <view name="datasets" /> <view name="reports" /> <view name="alerts" /> <view name="dashboards" /> <a href="http://dev.splunk.com/" target="_blank">Splunk Developer Portal</a> </nav> Tested with Chrome 71.0.3578.98, Firefox 64.0.2, Safari 12.0.2 on macOS 10.14.2. ... View more

In Splunk 7.2.x opening an external link in a new tab from the app navigation bar works. Example data/ui/nav/default.xml file including a link to the Splunk Developer Portal: <nav search_view="search"> <view name="search" default='true' /> <view name="datasets" /> <view name="reports" /> <view name="alerts" /> <view name="dashboards" /> <a href="http://dev.splunk.com/" target="_blank">Splunk Developer Portal</a> </nav> Tested with Chrome 71.0.3578.98, Firefox 64.0.2, Safari 12.0.2 on macOS 10.14.2. ... View more

According to the documentation, Workload Management is only supported on Linux operating system. https://docs.splunk.com/Documentation/Splunk/latest/Workloads/Requirements ... View more

Check if index=_internal sourcetype=splunkd component=BucketMover gives you what you are looking for. ... View more