Hi,
I am trying to make a dynamic query and seams not working as expected:
First i load a saved search
| savedsearch last7days_Table as table1
The Output table:
clients date_wday date_hour got
A friday 1 1
A friday 15 1
B friday 16 1
B friday 17 1
......
2.nd eval current weekday and current time
| eval Weekday=now()
| eval Weekday =strftime(Weekday," %A")
| eval Weekday=lower(Weekday)
| eval timenow=now()
| eval timenow=strftime(timenow," %H")
Then a select where weekday and
| where date_wday=Weekday AND date_hour=timenow
and the query do not return any data, if i do manually "| where date_wday="friday" AND date_hour=1"
it returns data.
Any ideas why the query is not returning the expected data ?
My guess is that there are blank spaces in timenow and Weekday.
This using trim:
| eval Weekday =trim(lower(strftime(now()," %A")))
| eval timenow=trim(strftime(now()," %H"))
| where date_wday=Weekday AND timenow=date_hour
thx bouth 🙂 working
My guess is that there are blank spaces in timenow and Weekday.
This using trim:
| eval Weekday =trim(lower(strftime(now()," %A")))
| eval timenow=trim(strftime(now()," %H"))
| where date_wday=Weekday AND timenow=date_hour
Alternatively remove the space from the strftime formats
| eval Weekday=now()
| eval Weekday =strftime(Weekday,"%A")
| eval Weekday=lower(Weekday)
| eval timenow=now()
| eval timenow=strftime(timenow,"%H")
Dave
Good point, didn't even notice that