topic Re: Can anyone help me to match a value into lookup.csv if condition in Splunk Search

Can anyone help me to match a value into lookup.csv if condition

louisawang — Tue, 29 Sep 2020 23:16:20 GMT

I have a lookup.csv with all the public holidays in Singapore.

I am trying to query if _time=datefield(meaning if today is a public holiday), SLA_DEADLINE +86400(deadline extend by 1 day).
I added a row called test and datefield is today, so by right, if _time =test, it should extend the deadline by 1 day.
This is my code:

    | eval today = strftime(_time,"%Y-%m-%d") 
    | lookup public_holiday.csv Public_Holiday output datefield 
    | rename datefield TO public_holiday 
    | eval SLA_DEADLINE = case((public_holiday==today),SLA_DEADLINE+86400,true(),SLA_DEADLINE)

But it isn't extending by 1 day, can anyone help me?

Re: Can anyone help me to match a value into lookup.csv if condition

lakshman239 — Wed, 13 Feb 2019 11:16:38 GMT

The output needs to be in caps - OUTPUT. Also, you want to input datefield to lookup and output Public_holiday to know if today is a public holiday. You can then change your logic/further checks for SLA.

Re: Can anyone help me to match a value into lookup.csv if condition

eduardKiyko — Wed, 13 Feb 2019 11:34:07 GMT

I added a couple of rows(third and sixth) for better understanding, in my case it works

Re: Can anyone help me to match a value into lookup.csv if condition

nickhills — Wed, 13 Feb 2019 12:11:36 GMT

Not tested, but this method uses a lookup 'properly'

| eval today = strftime(_time,"%Y-%m-%d") 
| lookup public_holiday.csv datefield as today OUTPUT Public_Holiday
| eval SLA_DEADLINE = if(isnull(Public_Holiday),SAL_DEADLINE,SLA_DEADLINE+86400)

Re: Can anyone help me to match a value into lookup.csv if condition

louisawang — Thu, 14 Feb 2019 02:59:19 GMT

Hello, thanks for your reply, do i need to edit anything on the props.conf or transforms.conf?

Re: Can anyone help me to match a value into lookup.csv if condition

louisawang — Thu, 14 Feb 2019 03:07:31 GMT

It gave me this error, Error in 'lookup' command: Must specify one or more lookup fields.
What does this error mean? Can you help me? Thank you!

Re: Can anyone help me to match a value into lookup.csv if condition

nickhills — Thu, 14 Feb 2019 08:31:54 GMT

Hello - sorry there was a mistake in my first post. I had got the inputs of the lookup round the wrong way (I was typing on my phone). I have corrected the example above, please give it another go.
No changes to props/trans.