Getting Data In

Apply a lookup only to events before a certain time

Shtark
Explorer

I need to apply a lookup only to events before a certain point in time (the data added by the lookup is now included in the events). I haven't seen anything to indicate that this could be done to a whole lookup, only per item in the lookup table (temporal lookup).

My only thought on how it might be possible was if a timestamp was added to each item in the lookup, max_offset_secs was set to 0 and min_offset_secs was negative but I don't know if that would be valid. The documentation for those settings only refers to the event being later than the timestamp in the lookup, not earlier.

Any ideas/answers gladly welcomed.

Tags (2)
0 Karma

woodcock
Esteemed Legend

The way to do a conditional lookup is to make sure that the input field is null for the events that should not have lookups. This is particularly useful for situations where the lookup is both expensive and guaranteed to fail (e.g. doing a dnslookup for IP addresses that you know are bogus). It works like this:

... | conditionalizedLookupField=if((_time<threshold_time), myLookupField, null() | lookup myLookup conditionalizedLookupField AS myLookupField OUTPUT myOutputField
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...