Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to output a certain field from a lookup based on comparing the event timestamp to start and end date values?

$
0
0
I have a set of events. Based on that timestamp, I need to do a lookup with different data which looks something like this: Start_Date End_Date Phase 11/16/2015 0:00 11/20/2015 23:59 Build 1 11/30/2015 0:00 1/15/2016 23:59 Testing Cycle A So if the Event occurred in the bucket of time that falls under build 1, I would need the output to have a new field Phase (along with existing fields of the events) which would mention what phase this event occurred in (Build 1 in this case). The table that has start_date, end_date, and phase has static values, but more phases will be added to it as we go into the future. How to I go about doing this new field creation based on the time comparison? Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>