Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Lookup based table in Splunk?

$
0
0
I have a search that searches indexes for all time, and retrieves values(1 field) and stores it in a lookup. I figured that if I set the earliest time and latest time for the search from a config file and somehow update the config file on a day to day basis, I can make the search faster. The problem here is that I need the lookup to populate values for "All time" only for the first time it runs. There on, it must run for the time specified in a file, let's say timeSettings.conf. I want to know if this is possible at all. **timeSettings.conf** earliestTime = ..... latestTime = ..... Thank you. Cheers.

Viewing all articles
Browse latest Browse all 47296

Trending Articles