Hi,
I've created time-based lookup definition which I want to use in my search. The example.csv has a time field "timestamp" and the maximum offset is 1800.
sourcetype=A
| lookup example.csv key OUTPUT flag
How is the maximum offset used here? In the results, every event is flagged, not only the events during the maximum offset.
BR
Heinz
In order for the lookup to be time-based, it must also include a "time_field" value within the transforms.conf definition. Given your description of the behavior, it sounds like you're not triggering a time-based lookup, or the time-stamp is not within the format specified in your time_format option within transforms.conf. If this setting is not provided, Splunk assumes that the time field is in epoch time.
Hi Heinz,
There is no row or column limitation on lookup table. default size is 10MB.
Refer the post Link
Cheers!