I have a inputlookup search where I am looking to do a current count vs four week average count. My search is set up so it uses : | inputlookup count.csv | bin _time span=5m
I need my search to display data from prior four weeks like below.
_time | c | Last Week | Two Weeks | Three Weeks Ago | Four weeks Ago | |
9/19/2021 15:10 | 265 | (Count from 9/12/2021 15:10) | (Count from 9/05/2021 15:10) | |||
9/19/2021 15:15 | 362 | (Count from 9/12/2021 15:15) | (Count from 9/05/2021 15:15) | |||
9/19/2021 15:20 | 589 | (Count from 9/12/2021 15:20) | (Count from 9/05/2021 15:20) | |||
9/19/2021 15:25 | 700 | (Count from 9/12/2021 15:25) | (Count from 9/05/2021 15:25) |
The problem is that I would normally use earliest and latest ( but these commands do not work with inputlooks. If anyone has solutions that work for inputlook it would be great!
I don't quite understand - what exactly does your lookup contain? Can you provide us with a sample? We already have desired output but we don't know the input.
The lookup only contains counts as seen in the table I have in the original post. My problem is I can't use earliest and latest commands to view historical data week by week.
I still don't understand what are the raw contents of the lookup. Anyway, doesn't ( | inputlookup | where _time<=something AND _time>=something) work?
You can add the search window time to the event using addinfo and then filter the events on the _time value in your lookup, e.g.
| addinfo
| where _time>=info_min_time AND _time<=info_max_time
so, if your search window is last 4 weeks, then this will return the events from the last 4 weeks only from the lookup.
Is that what you wanted?
If this is part of a dashboard search, then you could use the tokens from your time selector, e.g.
| inputlookup count.csv where _time>=$timerange.earliest$ AND _time<=$timerange.latest$
| where _time>=info_min_time AND _time<=info_max_time
to only display data from last 7 days (one week) if inputlook does not accept earliest and latest?
Your original post implied the lookup contained _time as a field. If you do not have a time field in your lookup then you can't filter by time. If you have a field called _time in your lookup, then do as I suggest in my previous post. There is a 3rd option which will make a fixed 7 day test (again assuming you have a time field in your lookup)
| inputlookup count.csv
| where _time>=relative_time(now(), "-7d@d") AND _time<=now()