Delete old data from lookupfile

Question

Hi,

I have a lookup file which will get update daily(from a scheduled search ), I need keep only last 45 days data in it, means data which is added 45 days back needs to be deleted.(we have _time field in lookup file)

Please let me know if there is any other way to store the data(which will update daily ) with out using lookup file.

Answer 1

4

This (should be) fairly trivial as part of your scheduled search that creates your lookup. I assume that your lookup is created roughly as follows:

some_search_terms | inputlookup append=true lookup.csv | 
some_other_stuff | outputlookup lookup.csv

Following this paradigm, you can insert something like this before the outputlookup:

| where _time >= now() - (86400 * 45)

link

answered 21 Jan '12, 10:38

dwaddle ♦
15.4k●2●9●24
accept rate: 33%

Delete old data from lookupfile

Follow this question

Splunk Resources

Related questions