Building for the Splunk Platform

Filtering out one field by time in a search

iiRajMahalii
Explorer

I have a lookup table with a few fields (FirstSeenDate, LastSeenDate, IP, etc...). I have a search created to show me the top 10 events in the table by count. What I want to do is add a part in the search to filter out anything that is older than 90 days in the FirstSeenDate column. 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To filter out events where FirstSeenDate is older than 10 days, insert this early in your query

| where strptime(FirstSeenDate, "%Y-%m-%d %H:%M:%S") < relative_time(now(), "-90d")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To filter out events where FirstSeenDate is older than 10 days, insert this early in your query

| where strptime(FirstSeenDate, "%Y-%m-%d %H:%M:%S") < relative_time(now(), "-90d")
---
If this reply helps you, Karma would be appreciated.

iiRajMahalii
Explorer

Thank you! That did the trick. I added this to the string right after the lookup.csv is being called. 

0 Karma

iiRajMahalii
Explorer

So far I just have it being listed as top 10 from the list. 

| stats count by dest_ip
| sort -count
| head 10
| rename dest_ip as LIST, count as "Events" | table LIST, "Events"
| lookup Lookup.csv LIST OUTPUT FirstSeenDate,LastSeenDate,TotalSeenCount
|rename LIST as "IP"| table "IP", "Events", FirstSeenDate,LastSeenDate,TotalSeenCount

The format of the FirstSeenDate is YYYY-mm-dd  HH:MM:SS

I want to have the results give me the top 10 events by count which it already does but also filter the FirstSeenDate as only list  the top 10 events from the last 3 months.

 

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That shouldn't be too difficult.  What have you tried so far?  What is the format of the FirstSeenDate field?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...