How to pull events from last 24 hours from a lookup table?

[wtaylor149]

I'm attempting to pull events that happened in the last 24 hours from a lookup table and create a daily report. No matter what combination I try (using bin, earliest and latest), nothing seems to pull the last 24 hours. Not even the time range picker on the right hand side of the search bar.

Here is an example of the search I'm running:

| inputlookup incident_review_lookup | bin _time span=24h | convert timeformat=%Y/%m/%d-%H:%M:%S ctime(time) AS _time | fields - time

Thanks for the help and guidance.

[hortonew]

I believe the following is necessary in order to filter time from a lookup. Set your search time to last 24 hours, then use something like the following:

| inputlookup incident_review_lookup 
| where  time >= [| gentimes start=-1 | addinfo | eval search=info_min_time | table search]
AND
time <= [| gentimes start=-1 | addinfo | eval search=info_max_time | table search]

| eval time=strftime(_time, "%Y-%h-%d %T")
| table time

This will filter based on the global splunk time settings you select from the time selector.

[wtaylor149]

Much appreciate the help but this did not work. All I get is a table of blank time.

[hortonew]

What is the time field called in your lookup table. Is it "time" ? You might need to rename it to _time before processing, and change the search above to use "_time" instead. I can do some testing in a little bit.