Getting Data In

I have a Report running on cron schedule but want to exclude running on federal holidays

gnshah12345
New Member

I have created a csv file with dates of federal holidays.
holiday_date
01/01/19
01/21/19

I am trying to run my search like below.
index=appxindex |eval today_date=strftime(_time,"%m/%d/%y") | search NOT [|inputlookup exclude_holidays.csv holiday_date as today_date ]
The above is not working. All I want to do is if today_date = holiday_date (in csv file), I do not want to search. Any ideas?

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@gnshah12345 ,

inputlookup doesnt have AS clause.

Try

index=appxindex |eval holiday_date=strftime(_time,"%m/%d/%y") 
| search NOT [|inputlookup exclude_holidays.csv|fields holiday_date]

OR

index=appxindex |eval today_date=strftime(_time,"%m/%d/%y") 
| search NOT [|inputlookup exclude_holidays.csv|rename holiday_date as today_date ]
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.