topic Re: Can you help me update some field values from a lookup table? in Splunk Search

Can you help me update some field values from a lookup table?

pench2k19 — Mon, 04 Feb 2019 12:41:03 GMT

Hi Team,

I have the following field values in a look up file

BUS_DT+1,11:00
BUS_DT+0,12:00

i want to update the field values into my query result. When there is BUS_DT+1 value, it should replace today's date in yyyy-mm-dd format, and when there is BUS_DT+0 value, it should print yesterday's date.

The expected result respectively is

2019-02-04, 11:00
2019-02-03,12:00

can anyone help on this use case. Thank you in advance

@vnravikumar @jkat54 @woodcock

Re: Can you help me update some field values from a lookup table?

vnravikumar — Mon, 04 Feb 2019 12:56:41 GMT

Hi @pench2k19

Try this and let me know. I considered two fields in lookup with date and time.

date,time
BUS_DT+1,11:00
BUS_DT+0,12:00


| inputlookup panel.csv 
| eval date1 = case(date="BUS_DT+1",strftime(now(),"%Y-%m-%d").",".time,date="BUS_DT+0",strftime(relative_time(time(), "-d"),"%Y-%m-%d".",".time))

Re: Can you help me update some field values from a lookup table?

jkat54 — Tue, 29 Sep 2020 23:08:48 GMT

BUS_DT+1,11:00
BUS_DT+0,12:00

| rex “\+(?<dayCount>\d+)\,(?<hourCount>\d+):(?<minuteCount>\d+)”
| eval _time=case(dayCount==1,now()+86400, dayCount==0,now(),1==1,0)
| eval newTimeStamp=strftime(strptime(_time, “%s),”%y-%m-%d, %H:%M:%S)

Re: Can you help me update some field values from a lookup table?

pench2k19 — Tue, 29 Sep 2020 23:04:37 GMT

@vnravikumar sorry for making you confused..its not two fields , the values belongs to single field

sl_time
BUS_DT+1,11:00
BUS_DT+0,12:00

Re: Can you help me update some field values from a lookup table?

vnravikumar — Mon, 04 Feb 2019 13:21:23 GMT

Hi @pench2k19

try this

Updated

| inputlookup panel.csv | rex field="sl_time" "(?P<date>.*)\,(?<time>.*)" | eval sl_time = case(date="BUS_DT+1",strftime(now(),"%Y-%m-%d").",".time,date="BUS_DT+0",strftime(relative_time(time(), "-d"),"%Y-%m-%d".",".time))

Re: Can you help me update some field values from a lookup table?

pench2k19 — Tue, 29 Sep 2020 23:04:40 GMT

the folloiwng giving me error @jkat54

| inputlookup SLA.csv | rex field=SOR_TDQ_FAIL_SLA_THRESHOLD “+(?\d+)\,(?\d+):(?\d+)”
| eval _time=case(dayCount==1,now()+86400, dayCount==0,now(),1==1,0)
| eval newTimeStamp=strftime(strptime(_time, “%s),”%y-%m-%d, %H:%M:%S) |table newTimeStamp

Re: Can you help me update some field values from a lookup table?

vnravikumar — Mon, 04 Feb 2019 13:30:08 GMT

try above query and let me know

Re: Can you help me update some field values from a lookup table?

pench2k19 — Mon, 04 Feb 2019 13:33:53 GMT

this works..thank you

Re: Can you help me update some field values from a lookup table?

vnravikumar — Mon, 04 Feb 2019 13:45:51 GMT

welcome 🙂