Splunk Search

Need ideas for lookups

jgauthier
Contributor

All,

I am correlating two non-related data types. Email to ERP Customers. I am going to accomplish this by referencing the recipient email address in the ERP customer information.

What I did was load all the ERP customer information into splunk, and then attempted to join them:

get_outbound_email | join recipientlist [search sourcetype="SalesGroups" |eval recipientlist=lower(recipientlist)]  

This actually worked pretty good. Then I ran into a a snag. I want relevant email (current) but the "SalesGroup" information is going to be loaded weekly. So, when I correlate events in the last 4 hours, or even 24 hours, the results are blank because splunk is trying to query the "SalesGroup" source for that time frame too.

I don't think a CSV lookup will suffice in this case, because it's 400k records. However, if it will I can attemp that route.

If I could ignore time on the subsearch, that would be ideal.

Thanks for the ideas!

Tags (2)
0 Karma
1 Solution

jgauthier
Contributor

BAH! That was too easy. earliest=-7d in the search string will work.

View solution in original post

0 Karma

jgauthier
Contributor

BAH! That was too easy. earliest=-7d in the search string will work.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...