Configure a time-based lookup

If your lookup table has a field that represents time, you can use it to create a time-bounded lookup. This is also referred to as a temporal lookup. You can configure all four lookup types as time-bounded lookups.

To create a time-bounded lookup, add the following lines to your lookup stanza in transforms.conf:

time_field = <field_name>
time_format = <string>

If the time_field attribute is present, max_matches = 1 by default and Splunk software applies the first matching entry in descending order. For more information about max_matches see "Add field matching rules to your lookup configuration," in this manual.

The time_format attribute specifies the strptime() format of the time_field attribute. The default value for the time_format attribute is %s.%Q, where you enter a Unix epoch time value in seconds (%s) and can optionally include milliseconds (%Q).

Note: You can use some nonstandard date-time strptime() formats. For example, when you define ISO 8601 timestamps (a Unix epoch time value in seconds), you can use time_format = '%s.%Q', where %s represents seconds and %Q represents milliseconds. See the subtopic "Enhanced strptime() support" in "Configure timestamp recognition," in the Getting Data In Manual.

For a match to occur with time-bounded lookups, you can also specify offsets for the minimum and maximum amounts of time that an event may be later than a lookup entry. To do this, add the following lines to your stanza:

max_offset_secs = <integer>
min_offset_secs = <integer>

By default there is no maximum offset. The default minimum offset is 0.

Time-based lookup example

Here's an example of a CSV lookup that uses DHCP logs to identify users on a network based on their IP address and the timestamp. The DHCP logs are in a file, dhcp.csv, which contains the timestamp, IP address, and the user's name and MAC address.

Prerequisities

• See about lookups and field actions for more information on lookups.
• See Make your lookup automatic for information on configuring an automatic lookup.

Steps

1. In a transforms.conf file, put:

   [dhcpLookup]
   filename = dhcp.csv
   time_field = timestamp
   time_format = %d/%m/%y %H:%M:%S
   

2. In a props.conf file, make the lookup automatic:

   [dhcp]
   LOOKUP-table = dhcpLookup ip mac OUTPUT user
   




3. Restart Splunk Enterprise.