{"id":16868,"date":"2020-07-31T17:36:08","date_gmt":"2020-07-31T17:36:08","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=16868"},"modified":"2020-07-31T17:36:08","modified_gmt":"2020-07-31T17:36:08","slug":"new-comment-on-reddit-1650","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=16868","title":{"rendered":"New comment on reddit"},"content":{"rendered":"<div class=\"md\">\n<p>If I understand you correctly, it <em>sounds<\/em> like you likely want a pair of searches &#8211; the first will run against the last 2 weeks, and dump the results into a lookup table<\/p>\n<p>The second will open the lookup table, grab only data from the last 24h, and send those<\/p>\n<p>Here&#39;s a <strong>very<\/strong> rough sample:<\/p>\n<pre><code>index=ndx sourcetype=srctp host=* ip=* earliest=-336h | eval when=_time | table host ip _time when | outputlookup twoweeks.csv <\/code><\/pre>\n<p>Follow-on:<\/p>\n<pre><code>| inputlookup twoweeks.csv | eval filter=now()-86400 | where when&gt;filter | table host ip _time <\/code><\/pre>\n<\/p><\/div>\n<p>July 31, 2020 at 01:11PM<br \/>\nvia reddit https:\/\/www.reddit.com\/r\/Splunk\/comments\/i18u05\/i_want_to_run_a_14_day_search_but_only_alert_on\/fzvwce5?utm_source=ifttt<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If I understand you correctly, it sounds like you likely want a pair of searches &#8211; the first will run against the last 2 weeks, and dump the results into a lookup table The second will open the lookup table, grab only data from the last 24h, and send those Here&#39;s a very rough sample: &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=16868\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">New comment on reddit<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[972],"keyring_services":[],"class_list":["post-16868","post","type-post","status-publish","format-standard","hentry","category-blih","tag-reddit"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/16868","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16868"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/16868\/revisions"}],"predecessor-version":[{"id":16869,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/16868\/revisions\/16869"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16868"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16868"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16868"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=16868"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}