Splunk Search

Purging lookup table of old entries

saurabhkunte
Path Finder

Hi All,

I have a lookup table where I am maintaining States of a field. It's rather a chatty table and grows to a large size over time. I would like to purge the entries in the lookup table older than 2 months and run this on daily schedule. How would I do that ?

The fields contain _time field which can be used to purge older rows in the lookup. Any help appreciated.

Thank you.

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@saurabhkunte,

Can you please try this search?

Execute this search for that time window span whose record you want to keep.

| inputlookup my_csv_lookup | addinfo | where ((NOT isnum(info_max_time)) OR _time > info_min_time AND _time < info_max_time)

This search will give you your expected rows in lookup.

| inputlookup my_csv_lookup | addinfo | where ((NOT isnum(info_max_time)) OR _time > info_min_time AND _time < info_max_time) | outputlookup my_csv_lookup

This search will overwrite lookup file with your expected rows.

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...