SPLUNK INPUTLOOKUP UPDATE

| where ( >= info_min_time AND <= info_max_time) If you HAVE included a time field in your lookup then you can also use 's solution above:

Once you have a time field, you can re-map it to the _time field, which should allow you to use search (you don't need latest=now(), Splunk assumes that if you don't provide a latest= statement). dedup OrderNumberlookup OrderDetailsLookup.csv OrderNumber OUTPUT otherLookupField search NOT otherLookupField. Then lets call that field 'otherLookupField' and then we can instead do. 2) at least one of those other fields is present on all rows.

SPLUNK INPUTLOOKUP UPDATE

You would need some logic that executes when you update / create your lookup to add a time value that equates to the execution time of the creation / update of the lookup. 1) theres some other field in here besides OrderNumber. Even if it DOES reference a time value, it may not be the time value you are thinking of. Example: indexproxy inputlookup urls. Often I use this command in a subsearch when I want to filter down my main search based on a list of field values I have stored in a CSV. This means that the owner also defines which fields to include in the lookup, which may or may not (most do not) have a field that references a time value. Inputlookup pulls in the contents of an entire file for you. Lookup files are basically state tables that the owner defines and updates.

index dedup clientip search inputlookup file. The user wanted a list of all IPs that existed in both the index and the inputlookup so I wrote a query similar to the following which lists ONLY the IPs that exist in both locations. If you have not included a time value anywhere in your lookup, then you cannot do this. I have an inputlookup table that has a list of details, specifically IPs.

Splunk inputlookup