Splunk Search

Need ideas for lookups

jgauthier
Contributor

All,

I am correlating two non-related data types. Email to ERP Customers. I am going to accomplish this by referencing the recipient email address in the ERP customer information.

What I did was load all the ERP customer information into splunk, and then attempted to join them:

get_outbound_email | join recipientlist [search sourcetype="SalesGroups" |eval recipientlist=lower(recipientlist)]  

This actually worked pretty good. Then I ran into a a snag. I want relevant email (current) but the "SalesGroup" information is going to be loaded weekly. So, when I correlate events in the last 4 hours, or even 24 hours, the results are blank because splunk is trying to query the "SalesGroup" source for that time frame too.

I don't think a CSV lookup will suffice in this case, because it's 400k records. However, if it will I can attemp that route.

If I could ignore time on the subsearch, that would be ideal.

Thanks for the ideas!

Tags (2)
0 Karma
1 Solution

jgauthier
Contributor

BAH! That was too easy. earliest=-7d in the search string will work.

View solution in original post

0 Karma

jgauthier
Contributor

BAH! That was too easy. earliest=-7d in the search string will work.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...