Dashboards & Visualizations

How to edit my inputlookup search to match the _time field from kvstore with the dashboard's time range picker?

lassel
Communicator

I have a heavy and complex search that runs as a scheduled search and saves its results in a lookup table.
The kvstore has a field called _time that is configured for time based lookups.

Now, I want to make a dashboard that searches my inputlookup.
So I add a panel with a search:

| inputlookup mylookup

But to my disappointment, I learned that searches that only hit a lookup doesn't support time pickers directly.

I tried this and a few other suggestions from answers.splunk.com, but I can't find answers that don't hard code the time range

| inputlookup mylookup earliest=$time.earliest$ latest=$time.latest$   

How can I modify my search, so the _time field gets matched to the time picker on my page?

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

First: If you have a requirement for _time based sorting and searching, do NOT use a kvstore. It wasn't designed for that. Instead, use summary indexing techniques which put the events back into searchable buckets with the correct time stamps. Then you can use a time picker to your heart's content over the summarized data. There really isn't anything you can do with the lookup to make it work like you wish.

Here is an oldie, but goodie on summary indexing. http://www.splunk.com/view/SP-CAAACZW

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

First: If you have a requirement for _time based sorting and searching, do NOT use a kvstore. It wasn't designed for that. Instead, use summary indexing techniques which put the events back into searchable buckets with the correct time stamps. Then you can use a time picker to your heart's content over the summarized data. There really isn't anything you can do with the lookup to make it work like you wish.

Here is an oldie, but goodie on summary indexing. http://www.splunk.com/view/SP-CAAACZW

lassel
Communicator

A summary index is a better solution. I must have skipped over it - so many concepts to learn 🙂

I have to add that to preserve extracted fields in my query I had to apply a hack that I found in another answer:

| rename _raw as orig_raw

http://answers.splunk.com/answers/22431/adding-host-field-when-summary-indexing.html

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...