Splunk Search

Using timechart earliest/latest with lookup files

lewisgrantevans
Explorer

Hi all,

I've created a _time field and timechart works for me, but the earliest/latest command does not. Here is my search -

| inputlookup mylookupfile.csv
| eval _time=strptime(Created,"%d/%m/%Y %H:%M")
| search Platform=ABC
| timechart span=1d dc("Issue key") AS "Count of Issue key"

As expected, I get all results from Sept 2018 to now in a timechart, in one day buckets. However, i'm trying to only show the previous week. The time range presets don't work. I have also tried many variations of the following -

| search earliest=-7d@d latest=-1d@d
| search earliest=-7d latest=-1d
| search earliest=-1w@w latest=-0w@w
| search _time earliest=-7d@d latest=-1d@d
| search _time earliest=-7d latest=-1d
| search _time earliest=-1w@w latest=-0w@w

I get zero results.

Is there any way to do this? I feel like i've read all of the other articles with similar issues but haven't found an answer that works for me.

Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi lewisgrantevans,
if you want to use the time picker, you cannot use lookups, did you explored the choice of summary indexes?
they are indexes with timestamp and all the fields you have in lookup, in other words they are lookups with a timestamp, they are very quick and don't consume license.
So you can schedule a search (the same that populates your lookup) and write results in a summary index adding as last row | collect index=my_summary .
Then you can search on this summary index.

Bye.
Giuseppe

0 Karma

jacobpevans
Motivator

Greetings @lewisgrantevans,

Have you tried just setting the time picker via GUI? I believe the timechart uses those values for what it displays.

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...