Splunk Dev

Filtering out one field by time in a search

iiRajMahalii
Explorer

I have a lookup table with a few fields (FirstSeenDate, LastSeenDate, IP, etc...). I have a search created to show me the top 10 events in the table by count. What I want to do is add a part in the search to filter out anything that is older than 90 days in the FirstSeenDate column. 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To filter out events where FirstSeenDate is older than 10 days, insert this early in your query

| where strptime(FirstSeenDate, "%Y-%m-%d %H:%M:%S") < relative_time(now(), "-90d")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To filter out events where FirstSeenDate is older than 10 days, insert this early in your query

| where strptime(FirstSeenDate, "%Y-%m-%d %H:%M:%S") < relative_time(now(), "-90d")
---
If this reply helps you, Karma would be appreciated.

iiRajMahalii
Explorer

Thank you! That did the trick. I added this to the string right after the lookup.csv is being called. 

0 Karma

iiRajMahalii
Explorer

So far I just have it being listed as top 10 from the list. 

| stats count by dest_ip
| sort -count
| head 10
| rename dest_ip as LIST, count as "Events" | table LIST, "Events"
| lookup Lookup.csv LIST OUTPUT FirstSeenDate,LastSeenDate,TotalSeenCount
|rename LIST as "IP"| table "IP", "Events", FirstSeenDate,LastSeenDate,TotalSeenCount

The format of the FirstSeenDate is YYYY-mm-dd  HH:MM:SS

I want to have the results give me the top 10 events by count which it already does but also filter the FirstSeenDate as only list  the top 10 events from the last 3 months.

 

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That shouldn't be too difficult.  What have you tried so far?  What is the format of the FirstSeenDate field?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...