#SPLUNK INPUTLOOKUP WITH EARLIEST HOW TO#

Then you could set up the search for the dashboard panel to simply be the value of the token from the dropdown.

Finally, we used outputlookup to output all these results to mylookup. Next, we used inputlookup to append the existing rows in mylookup, by using the appendtrue option. The addinfo command adds your earliest/latest times as chosen by the timepicker and. First, we told Splunk to retrieve the new data and retain only the fields needed for the lookup table. This expanded search will be index=proxy123 activity='download' OR OR may be more suitable to your data. You could try setting up your dropdown query to load the values from the lookup file using the inputlookup command. inputlookup mytable.csv eval timestrptime(mytime,Y-m-d). This approach assumes that you have the username field extracted in the first place. Try the following Dashboard code, which uses multiselect to reach Dates from startenddate.csv (you can use your own lookup filename instead). What happens here in the subsearch (the bit in the ) is that the subsearch will be expanded first, in this case, to OR OR So your main search will turn into index=proxy123 activity='download' OR OR may be more efficient than returning all the data in the index, then discarding anything that doesn't match the list of users. Try putting your subsearch as part of your base search: index sourcetype eventtype inputlookup clusName.csv fields cluster stats values (eventtype) as Eventtype values (source) as Source values (host) as Host by cluster. For example, to start your search an hour ago use either of the following time modifiers. Now, depending on the volume of data you have in your index and how much data is being discarded when not matching a username in the CSV, there may be alternate approaches you can try, for example, this one using a subsearch. Try the following index=proxy123 activity='download' | lookup username.csv users AS username OUTPUT users | where isnotnull(users)

Also, it doesnt look like you closed the search it appears to be missing a closing. earliesttime() Returns the UNIX time of the chronologically earliest-seen occurrence of a given field value.

#SPLUNK INPUTLOOKUP WITH EARLIEST HOW TO#

Fortunately, the lookup command has a mechanism for renaming the fields during the lookup. The problem is that you are setting earliesttime and latesttime - but Splunk does not know how to relate that to the time field that you have defined in your lookup table. In the lookup file, the name of the field is users, whereas in the event, it is username.

Splunk inputlookup with earliest