Splunk Search

Purging lookup table of old entries

saurabhkunte
Path Finder

Hi All,

I have a lookup table where I am maintaining States of a field. It's rather a chatty table and grows to a large size over time. I would like to purge the entries in the lookup table older than 2 months and run this on daily schedule. How would I do that ?

The fields contain _time field which can be used to purge older rows in the lookup. Any help appreciated.

Thank you.

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@saurabhkunte,

Can you please try this search?

Execute this search for that time window span whose record you want to keep.

| inputlookup my_csv_lookup | addinfo | where ((NOT isnum(info_max_time)) OR _time > info_min_time AND _time < info_max_time)

This search will give you your expected rows in lookup.

| inputlookup my_csv_lookup | addinfo | where ((NOT isnum(info_max_time)) OR _time > info_min_time AND _time < info_max_time) | outputlookup my_csv_lookup

This search will overwrite lookup file with your expected rows.

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...