Custom Condition in Alert

[pdash]

I want to have a custom condition where am comparing two fields of my search. One returns the current day (%e) and the other returns date_mday. How do I write this condition because %e has a space before it. So should it be like this?

search currentday = " "+date_mday

How to concatenate the space or is there a way i can get the current day without that space or a zero

[pdash]

Found the solution. So in this alert I wanted to compare date_mday with my Today field and trigger an alert when it happens today. Here goes the details

The query would be:
index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024 | stats sum(MB) as TotalMBUsed by pool, date_mday|eval Today=trim((strftime(now(), "%e")), " ")| eval MBExceededBy = 512000 - TotalMBUsed |eval MBAvailable = 512000 |eval Environment = "DEV" |eval TriggeredOn = if((match(date_mday,Today)), "Today", date_mday)|where TotalMBUsed > 512000

Time Range is @mon to now

Custom Condtion is "search TriggeredOn = Today"

This would trigger the alert on the day a violation occurs and the alert table will have all the violation of that month so that you know how many violations you have done in this month.

[pdash]

Just found out in alert condition you need to use . to concatenate search currentday = " ".date_mday