Hi,
I have a lookup file which will get update daily(from a scheduled search ), I need keep only last 45 days data in it, means data which is added 45 days back needs to be deleted.(we have _time field in lookup file)
Please let me know if there is any other way to store the data(which will update daily ) with out using lookup file.
This (should be) fairly trivial as part of your scheduled search that creates your lookup. I assume that your lookup is created roughly as follows:
some_search_terms | inputlookup append=true lookup.csv |
some_other_stuff | outputlookup lookup.csv
Following this paradigm, you can insert something like this before the outputlookup
:
| where _time >= now() - (86400 * 45)