Splunk Search

How is the maximum offset used in my time-based lookup search?

HeinzWaescher
Motivator

Hi,

I've created time-based lookup definition which I want to use in my search. The example.csv has a time field "timestamp" and the maximum offset is 1800.

 sourcetype=A
 | lookup example.csv key OUTPUT flag

How is the maximum offset used here? In the results, every event is flagged, not only the events during the maximum offset.

BR

Heinz

Tags (3)
0 Karma

sowings
Splunk Employee
Splunk Employee

In order for the lookup to be time-based, it must also include a "time_field" value within the transforms.conf definition. Given your description of the behavior, it sounds like you're not triggering a time-based lookup, or the time-stamp is not within the format specified in your time_format option within transforms.conf. If this setting is not provided, Splunk assumes that the time field is in epoch time.

0 Karma

vasanthmss
Motivator

Hi Heinz,

There is no row or column limitation on lookup table. default size is 10MB.

Refer the post Link

Cheers!

V
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...