https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251819#M75287 <P>It is not giving me dates in a single cell of the same daterange but instead its dividing it. Please help</P> Tue, 06 Dec 2016 10:33:32 GMT saura1312 2016-12-06T10:33:32Z https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251815#M75283 <PRE><CODE> eval dates=mvrange(strptime(insrt_date,"%Y-%m-%d"),strptime(updt_date,"%Y-%m-%d"),86400) | convert ctime(dates) timeformat="%A" | eval dates=mvfilter(NOT match(dates,"(Saturday|Sunday)")) </CODE></PRE> <P>I have my search to exclude the weekends. Can someone help me with how to include lookup in my search so it excludes the days present in my holiday lookup?</P> Wed, 30 Nov 2016 16:38:07 GMT https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251815#M75283 saura1312 2016-11-30T16:38:07Z https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251816#M75284 <P>Try this</P> <PRE><CODE>eval date=mvrange(strptime(insrt_date,"%Y-%m-%d"),strptime(updt_date,"%Y-%m-%d"),86400) | convert ctime(date) as dates timeformat="%A" | eval dates=mvfilter(NOT match(dates,"(Saturday|Sunday)")) | mvexpand date | search NOT [| inputlookup lookupfile.csv | eval datefield=strptime(datefield, "%Y-%m-%d") | rename datefield=date | fields date] </CODE></PRE> Wed, 30 Nov 2016 17:49:09 GMT https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251816#M75284 sundareshr 2016-11-30T17:49:09Z https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251817#M75285 <P>Can you please show me how my lookup table should look like?</P> Wed, 30 Nov 2016 21:08:57 GMT https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251817#M75285 saura1312 2016-11-30T21:08:57Z https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251818#M75286 <P>Your lookup table should have at least the date for the holidays in a field called <CODE>datefield</CODE>. The format for the dates should be <CODE>%Y-%m-%d</CODE>. You can have additional fields, if you choose.</P> Wed, 30 Nov 2016 21:10:26 GMT https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251818#M75286 sundareshr 2016-11-30T21:10:26Z https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251819#M75287 <P>It is not giving me dates in a single cell of the same daterange but instead its dividing it. Please help</P> Tue, 06 Dec 2016 10:33:32 GMT https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251819#M75287 saura1312 2016-12-06T10:33:32Z https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251820#M75288 <P>It is not giving me dates in a single cell of the same daterange but instead its dividing it. Please help</P> Tue, 06 Dec 2016 14:06:51 GMT https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251820#M75288 saura1312 2016-12-06T14:06:51Z https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251821#M75289 <P>Not sure I understand. Can you share some samples?</P> Tue, 06 Dec 2016 15:20:17 GMT https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251821#M75289 sundareshr 2016-12-06T15:20:17Z https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251822#M75290 <PRE><CODE>eval date=mvrange(strptime(insrt_date,"%Y-%m-%d"),strptime(updt_date,"%Y-%m-%d"),86400) </CODE></PRE> <P>this will give me dates in a single row cell like below</P> <PRE><CODE>1. 2016-09-23 2016-09-24 2016-09-25 2016-09-26 </CODE></PRE> <P>Now when i put the date for the lookup to compare and exclude holidays it gives me dates in different rows like</P> <PRE><CODE>1. 2016-09-23 2. 2016-09-24 3. 2016-09-25 4. 2016-09-26 </CODE></PRE> <P>I don't want them in different rows</P> Tue, 06 Dec 2016 16:25:56 GMT https://community.splunk.com/t5/Splunk-Search/How-edit-my-search-to-exclude-holidays-with-the-help-of-lookup/m-p/251822#M75290 saura1312 2016-12-06T16:25:56Z